Signed-off-by: Dave Sugar <dsugar@xxxxxxxxxx>
---
policy/modules/system/iptables.if | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/policy/modules/system/iptables.if b/policy/modules/system/iptables.if
index 725a6a3d..a36277a6 100644
--- a/policy/modules/system/iptables.if
+++ b/policy/modules/system/iptables.if
@@ -183,6 +183,25 @@ interface(`iptables_dontaudit_read_pids',`
dontaudit $1 iptables_runtime_t:file read;
')
+########################################
+## <summary>
+## Allow specified domain to start and stop iptables service
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`iptables_startstop',`
+ gen_require(`
+ type iptables_unit_t;
+ class service { start stop };
+ ')
+
+ allow $1 iptables_unit_t:service { start stop };
+')
+
########################################
## <summary>
## Allow specified domain to get status of iptables service
--
2.20.1
