Description of problem:

Debian/Ubuntu has had support for "aclexec" option in /etc/hosts.allow and/or /etc/hosts.deny in tcp_wrappers via a custom patch since 2006.

Fedora 22 recently added support for "aclexec" aswell:
https://bugzilla.redhat.com/show_bug.cgi?id=1181815

That option is very handy for being able to integrate custom user provided ACL scripts for controlling access to services. 

An example how one might use "aclexec" in "/etc/hosts.allow":

servicename: ALL: aclexec /usr/local/bin/aclfilter.sh %a

if "aclfilter.sh" returns TRUE for the connecting IP then access is allowed, but if it returns FALSE access is denied. Very handy for integrating DNS RBL's and other IP databases via custom scripts.

Version-Release number of selected component (if applicable):
tcp_wrappers-7.6-77.el7

Actual results:
RHEL7 doesn't provide support for the aclexec option today.

Expected results:
RHEL7 provides support for aclexec option, like Fedora 22, Debian and Ubuntu do.


Additional info:

"aclexec" patch which was added to F22 tcp_wrappers rpms:
http://anonscm.debian.org/cgit/users/md/tcp-wrappers.git/commit/?h=patch-queue/master&id=51e7d82c0b6abf9cfaaccaeda185e6eeda05539b


Debian tcp_wrappers changelog:
http://archive.debian.net/changelogs/pool/main/t/tcp-wrappers/current/changelog.html

which contains an entry from 2006:
"New patch aclexec: adds the aclexec command and its documentation".


Documentation about aclexec:
http://manpages.ubuntu.com/manpages/trusty/man5/hosts_options.5.html

RUNNING OTHER COMMANDS

       aclexec shell_command
              Execute,  in a child process, the specified shell command, after
              performing   the   %<letter>   expansions   described   in   the
              hosts_access(5)  manual  page.   The  command  is  executed with
              stdin, stdout and stderr connected to the null device,  so  that
              it won't mess up the conversation with the client host. Example:

                 smtp : ALL : aclexec checkdnsbl %a

              executes,  in  a  background  child  process,  the shell command
              "checkdnsbl %a" after replacing %a by the address of the  remote
              host.

              The  connection  will be allowed or refused depending on whether
              the command returns a true or false exit status.