Bug 495370 - iptables-save refuses to redirect output to a file
Summary: iptables-save refuses to redirect output to a file
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 10
Hardware: x86_64
OS: Linux
low
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-04-12 12:50 UTC by Joel Uckelman
Modified: 2009-06-22 08:36 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2009-06-22 08:36:15 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Joel Uckelman 2009-04-12 12:50:28 UTC
Description of problem:

This awfully weird. iptables-save will, as expected, dump the current firewall rules to stdout. However, I get an empty file when I try to redirect that output to a file. I'm doing this as root, I'm not overwriting an existing file, the filesystem is not full.

If I pipe the output of iptables-save through cat first, the result makes it to the file:

[root@test sysconfig]# iptables-save | cat >foo

This happens on both of my 64-bit F10 systems, but not on my 32-bit systems.


Version-Release number of selected component (if applicable):

iptables-1.4.1.1-2.fc10.x86_64

How reproducible:

Always, on 64-bit systems.


Steps to Reproduce:
1. iptables-save
2. iptables-save >foo
  
Actual results:

foo is an empty file, instead of containing the output of iptables-save


Expected results:

foo should contain the output you'd get from running iptables-save

Comment 1 Thomas Woerner 2009-04-14 09:20:08 UTC
This is a SELinux problem. Assigning to selinux-policy-targeted.

Comment 2 Daniel Walsh 2009-04-14 14:56:47 UTC
Miroslav, I think we should not label iptabels-save as iptables_exec_t

Change iptables.fc to look like

/sbin/ip6?tables		--	gen_context(system_u:object_r:iptables_exec_t,s0)
/sbin/ip6?tables-restore 	--	gen_context(system_u:object_r:iptables_exec_t,s0)
/sbin/ip6?tables-multi 	--	gen_context(system_u:object_r:iptables_exec_t,s0)

Joel, if you chcon -t bin_t /sbin/iptables-save

Should fix the problem,

Comment 3 Miroslav Grepl 2009-04-14 16:50:04 UTC
Fixed in selinux-policy-3.5.13-56.fc10

Comment 4 Joel Uckelman 2009-06-21 11:26:14 UTC
I've verified that this is fixed in selinux-policy-3.5.13-61.fc10, and also in selinux-policy-3.6.12-50.fc11.

Thanks!

Comment 5 Miroslav Grepl 2009-06-22 08:36:15 UTC
Thanks for confirmation


Note You need to log in before you can comment on or make changes to this bug.