Description of problem:

The provided copy of /etc/selinux/targeted/contexts/files/file_contexts gives conflicting contexts for the /etc/sysconfig/iptables and /etc/sysconfig/iptables.save files.

The iptables and iptables-services packages include a script (/usr/libexec/iptables/iptables.init) that, when configured to "save" before exiting, will first iptables-save into a temporary file created via mktemp, and upon success will _copy_ the file /etc/sysconfig/iptables into /etc/sysconfig/iptables.save.  However, because the selinux policy provided by this component for these files differs, the copy fails.  Subsequently, the return status is checked, and only if the copy was successful is the temporary file moved to overwrite /etc/sysconfig/iptables.

In short, the "save before exiting" feature is broken by the SELinux policy.

Version-Release number of selected component (if applicable):

$ rpm -qa | grep selinux-policy-targeted
selinux-policy-targeted-3.14.3-41.fc30.noarch

How reproducible:

Simply need a system with selinux-policy-targeted as well as the iptables-services package.

Steps to Reproduce:
1. Ensure that selinux is set to enforce.
2. Install the iptables and iptables-services packages.
3. In /etc/sysconfig/iptables-config, set IPTABLES_SAVE_ON_STOP and IPTABLES_SAVE_ON_RESTART to "yes".
4. Stop and start iptables.service a few times, and check "journalctl -u iptables" for an error like this:

     iptables: Saving firewall rules to /etc/sysconfig/iptables: chmod: changing permissions of '/etc/sysconfig/iptables.save': Permission denied

5. Temporarily suspend selinux's enforcement and try restarting iptables again.
6. Observe that the iptables-save succeeds without error.

Actual results:

With the IPTABLES_SAVE_{ON_STOP,ON_RESTART} variables set to "yes", /usr/libexec/iptables/iptables.init attempts to copy the file /etc/sysconfig/iptables (with security context system_u:object_r:system_conf_t:s0) to /etc/sysconfig/iptables.save. (with security context system_u:object_r:etc_runtime_t:s0)  This results in an error.

In other words, /etc/sysconfig/iptables and /etc/sysconfig/iptables.save should have the same selinux contexts, but they do not:

$ ls -lahZ /etc/sysconfig/iptables{,.save}
-rw-------. 1 root root system_u:object_r:system_conf_t:s0 16K Jan 01 13:37 /etc/sysconfig/iptables
-rw-r--r--. 1 root root system_u:object_r:etc_runtime_t:s0 16K Jan 02 13:03 /etc/sysconfig/iptables.save

Expected results:

The selinux policy permits the copy that /usr/libexec/iptables/iptables.init performs by applying the same context to all of the /etc/sysconfig/ip6?tables{,.save} files.

Additional info:

I noticed that file_contexts includes two different entries that are the source of the disparate policies:

$ cat /etc/selinux/targeted/contexts/files/file_contexts | grep '/etc/sysconfig/ip.*tables.*'
/etc/sysconfig/ip6?tables.*	--	system_u:object_r:system_conf_t:s0
/etc/sysconfig/iptables\.save	--	system_u:object_r:etc_runtime_t:s0

Couldn't one just remove the latter? I.e. remove the line:

    /etc/sysconfig/iptables\.save	--	system_u:object_r:etc_runtime_t:s0

from the policy?  I also note that there is an ip6tables.save counterpart to this file which is not mentioned here.