Created attachment 1012952 [details]
Patch for /etc/init.d/{iptables,ip6tables}

Description of problem:
When the security table is being used (e.g. secmark) the iptables and ip6tables init scripts fail in set_policy() due to not recognizing the security table.  In order to preserve the separation between the host-based firewall rules and SELinux based secmark labeling the init scripts should be made *aware* of the security table so the scripts do not fail, but the should not take any action against the security table in set_policy() .

Version-Release number of selected component (if applicable):
iptables-1.4.7-16.el6.x86_64
iptables-ipv6-1.4.7-16.el6.x86_64

How reproducible:
Every time.

Steps to Reproduce:
1. service iptables start
2. /sbin/iptables -t security -A FORWARD -p icmp -j LOG
3. service iptables stop

Actual results:
# service iptables start
iptables: Applying firewall rules:                         [  OK  ]
# /sbin/iptables -t security -A FORWARD -p icmp -j LOG
# service iptables stop
iptables: Setting chains to policy ACCEPT: security filter [FAILED]
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Unloading modules:                               [  OK  ]

Expected results:
# service iptables start
iptables: Applying firewall rules:                         [  OK  ]
# /sbin/iptables -t security -A FORWARD -p icmp -j LOG
# service iptables stop
iptables: Setting chains to policy ACCEPT: security filter [  OK  ]
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Unloading modules:                               [  OK  ]

Additional info:
The same problem applies to both the IPv4 and IPv6 init scripts.