[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/kernel/

[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/kernel/

[Sven Vermeulen]

commit:     01775f1aa6754ec1b90f1497fbe08592c710e4a3
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Aug  8 12:33:18 2014 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Fri Aug 15 09:57:59 2014 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=01775f1a

Introduce kernel_delete_unlabeled_symlinks

The kernel_delete_unlabeled_symlinks interface is called by the
files_delete_isid_type_symlinks interface (in kernel/files.if). This
interface is deprecated (and calls kernel_delete_unlabeled_symlinks).

Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/kernel/kernel.if | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index 18cef42..0ef8242 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -2556,6 +2556,24 @@ interface(`kernel_dontaudit_read_unlabeled_files',`
 
 ########################################
 ## <summary>
+##	Delete unlabeled symbolic links.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`kernel_delete_unlabeled_symlinks',`
+	gen_require(`
+		type unlabeled_t;
+	')
+
+	delete_lnk_files_pattern($1, unlabeled_t, unlabeled_t)
+')
+
+########################################
+## <summary>
 ##	Create, read, write, and delete unlabeled symbolic links.
 ## </summary>
 ## <param name="domain">

[gentoo-commits] proj/hardened-refpolicy:salt commit in: policy/modules/kernel/

[Sven Vermeulen]

commit:     01775f1aa6754ec1b90f1497fbe08592c710e4a3
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Aug  8 12:33:18 2014 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Fri Aug 15 09:57:59 2014 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=01775f1a

Introduce kernel_delete_unlabeled_symlinks

The kernel_delete_unlabeled_symlinks interface is called by the
files_delete_isid_type_symlinks interface (in kernel/files.if). This
interface is deprecated (and calls kernel_delete_unlabeled_symlinks).

Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/kernel/kernel.if | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index 18cef42..0ef8242 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -2556,6 +2556,24 @@ interface(`kernel_dontaudit_read_unlabeled_files',`
 
 ########################################
 ## <summary>
+##	Delete unlabeled symbolic links.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`kernel_delete_unlabeled_symlinks',`
+	gen_require(`
+		type unlabeled_t;
+	')
+
+	delete_lnk_files_pattern($1, unlabeled_t, unlabeled_t)
+')
+
+########################################
+## <summary>
 ##	Create, read, write, and delete unlabeled symbolic links.
 ## </summary>
 ## <param name="domain">

[gentoo-commits] proj/hardened-refpolicy:salt commit in: policy/modules/kernel/

[Sven Vermeulen]

commit:     376cc6ab8bf4ebc9d108d35bbc7c93a98f439efc
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Aug  8 12:33:19 2014 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Fri Aug 15 09:58:01 2014 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=376cc6ab

Introduce kernel_delete_unlabeled_pipes

The kernel_delete_unlabeled_pipes interface is called by the
(deprecated) files_delete_isid_type_fifo_files interface in
kernel/files.if.

Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/kernel/kernel.if | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index 0ef8242..035f101 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -2835,6 +2835,24 @@ interface(`kernel_relabelfrom_unlabeled_pipes',`
 
 ########################################
 ## <summary>
+##	Delete unlabeled named pipes
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`kernel_delete_unlabeled_pipes',`
+	gen_require(`
+		type unlabeled_t;
+	')
+
+	delete_fifo_files_pattern($1, unlabeled_t, unlabeled_t)
+')
+
+########################################
+## <summary>
 ##	Allow caller to relabel unlabeled named sockets.
 ## </summary>
 ## <param name="domain">

[gentoo-commits] proj/hardened-refpolicy:salt commit in: policy/modules/kernel/

[Sven Vermeulen]

commit:     3523edf717419a72bfa83870909a7c9a66caefa7
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Thu Aug 14 18:22:33 2014 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Fri Aug 15 10:04:11 2014 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=3523edf7

Support salt ports 4505 and 4506

---
 policy/modules/kernel/corenetwork.te.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
index c5fa3f7..47efbdb 100644
--- a/policy/modules/kernel/corenetwork.te.in
+++ b/policy/modules/kernel/corenetwork.te.in
@@ -237,6 +237,7 @@ network_port(rsync, tcp,873,s0, udp,873,s0)
 network_port(rtorrent, udp, 6881, s0)
 network_port(rtsp, tcp,554,s0, udp,554,s0)
 network_port(rwho, udp,513,s0)
+network_port(salt, tcp,4505,s0, tcp,4506,s0)
 network_port(sap, tcp,9875,s0, udp,9875,s0)
 network_port(servistaitsm, tcp,3636,s0, udp,3636,s0)
 network_port(sieve, tcp,4190,s0)

[gentoo-commits] proj/hardened-refpolicy:salt commit in: policy/modules/kernel/

[Sven Vermeulen]

commit:     6207dd32f1345e9740d1108cf7a7be30d848c427
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Aug  8 12:33:21 2014 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Fri Aug 15 09:58:05 2014 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=6207dd32

Introduce kernel_delete_unlabeled_blk_files

The kernel_delete_unlabeled_blk_files interface is called by the
(deprecated) files_delete_isid_type_blk_files in kernel/files.if.

Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/kernel/kernel.if | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index 0ed9d53..5d978cc 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -2686,6 +2686,24 @@ interface(`kernel_rw_unlabeled_blk_files',`
 
 ########################################
 ## <summary>
+##	Delete unlabeled block device nodes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`kernel_delete_unlabeled_blk_files',`
+	gen_require(`
+		type unlabeled_t;
+	')
+
+	delete_blk_files_pattern($1, unlabeled_t, unlabeled_t)
+')
+
+########################################
+## <summary>
 ##	Create, read, write, and delete unlabeled block device nodes.
 ## </summary>
 ## <param name="domain">

[gentoo-commits] proj/hardened-refpolicy:salt commit in: policy/modules/kernel/

[Sven Vermeulen]

commit:     044584b198f2b155849e5f00f9fdeb7531882d28
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Aug  8 12:33:22 2014 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Fri Aug 15 09:58:07 2014 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=044584b1

Introduce kernel_delete_unlabeled_chr_files

The kernel_delete_unlabeled_chr_files interface is called by the
(deprecated) files_delete_isid_type_chr_files interface in
kernel/files.if.

Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/kernel/kernel.if | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index 5d978cc..c100068 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -2760,6 +2760,25 @@ interface(`kernel_dontaudit_write_unlabeled_chr_files',`
 
 ########################################
 ## <summary>
+##	Delete unlabeled character device nodes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`kernel_delete_unlabeled_chr_files',`
+	gen_require(`
+		type unlabeled_t;
+	')
+
+	delete_chr_files_pattern($1, unlabeled_t, unlabeled_t)
+')
+
+
+########################################
+## <summary>
 ##	Create, read, write, and delete unlabeled character device nodes.
 ## </summary>
 ## <param name="domain">

[gentoo-commits] proj/hardened-refpolicy:salt commit in: policy/modules/kernel/

[Sven Vermeulen]

commit:     a8166f08f9c7f9702c9e7e218da82bcc181c6cf8
Author:     Chris PeBenito <cpebenito <AT> tresys <DOT> com>
AuthorDate: Thu Aug 14 19:49:59 2014 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Fri Aug 15 09:58:09 2014 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=a8166f08

Module version bump for missing unlabeled interfaces from Sven Vermeulen.

---
 policy/modules/kernel/kernel.te | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index 5d6da7f..4e39c2c 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -1,4 +1,4 @@
-policy_module(kernel, 1.18.1)
+policy_module(kernel, 1.18.2)
 
 ########################################
 #

[gentoo-commits] proj/hardened-refpolicy:salt commit in: policy/modules/kernel/

[Sven Vermeulen]

commit:     536d7e19de29d9c93f31f3ac71698b9730ac96f9
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Aug  8 12:33:20 2014 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Fri Aug 15 09:58:02 2014 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=536d7e19

Introduce kernel_delete_unlabeled_sockets

The kernel_delete_unlabeled_sockets interface is called by the
(deprecated) files_delete_isid_type_sock_files interface in
kernel/files.if.

Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/kernel/kernel.if | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index 035f101..0ed9d53 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -2872,6 +2872,23 @@ interface(`kernel_relabelfrom_unlabeled_sockets',`
 
 ########################################
 ## <summary>
+##	Delete unlabeled named sockets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`kernel_delete_unlabeled_sockets',`
+	gen_require(`
+		type unlabeled_t;
+	')
+
+	delete_sock_files_pattern($1, unlabeled_t, unlabeled_t)
+')
+########################################
+## <summary>
 ##	Send and receive messages from an
 ##	unlabeled IPSEC association.
 ## </summary>

[gentoo-commits] proj/hardened-refpolicy:salt commit in: policy/modules/kernel/

[Sven Vermeulen]

commit:     d47c778ccbce70463fed9a0ddd79c41570508f86
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Aug 15 13:39:08 2014 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Fri Aug 15 13:39:08 2014 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=d47c778c

Add built version of corenetwork.if with salt ports

---
 policy/modules/kernel/corenetwork.if | 443 +++++++++++++++++++++++++++++++++++
 1 file changed, 443 insertions(+)

diff --git a/policy/modules/kernel/corenetwork.if b/policy/modules/kernel/corenetwork.if
index 22e8137..5431c56 100644
--- a/policy/modules/kernel/corenetwork.if
+++ b/policy/modules/kernel/corenetwork.if
@@ -75813,6 +75813,449 @@ interface(`corenet_relabelto_rwho_server_packets',`
 
 ########################################
 ## <summary>
+##	Send and receive TCP traffic on the salt port.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="both" weight="10"/>
+#
+interface(`corenet_tcp_sendrecv_salt_port',`
+	gen_require(`
+		type salt_port_t;
+	')
+
+	allow $1 salt_port_t:tcp_socket { send_msg recv_msg };
+')
+
+########################################
+## <summary>
+##	Send UDP traffic on the salt port.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="write" weight="10"/>
+#
+interface(`corenet_udp_send_salt_port',`
+	gen_require(`
+		type salt_port_t;
+	')
+
+	allow $1 salt_port_t:udp_socket send_msg;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to send UDP traffic on the salt port.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_dontaudit_udp_send_salt_port',`
+	gen_require(`
+		type salt_port_t;
+	')
+
+	dontaudit $1 salt_port_t:udp_socket send_msg;
+')
+
+########################################
+## <summary>
+##	Receive UDP traffic on the salt port.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="read" weight="10"/>
+#
+interface(`corenet_udp_receive_salt_port',`
+	gen_require(`
+		type salt_port_t;
+	')
+
+	allow $1 salt_port_t:udp_socket recv_msg;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to receive UDP traffic on the salt port.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_dontaudit_udp_receive_salt_port',`
+	gen_require(`
+		type salt_port_t;
+	')
+
+	dontaudit $1 salt_port_t:udp_socket recv_msg;
+')
+
+########################################
+## <summary>
+##	Send and receive UDP traffic on the salt port.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="both" weight="10"/>
+#
+interface(`corenet_udp_sendrecv_salt_port',`
+	corenet_udp_send_salt_port($1)
+	corenet_udp_receive_salt_port($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to send and receive
+##	UDP traffic on the salt port.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_dontaudit_udp_sendrecv_salt_port',`
+	corenet_dontaudit_udp_send_salt_port($1)
+	corenet_dontaudit_udp_receive_salt_port($1)
+')
+
+########################################
+## <summary>
+##	Bind TCP sockets to the salt port.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_tcp_bind_salt_port',`
+	gen_require(`
+		type salt_port_t;
+	')
+
+	allow $1 salt_port_t:tcp_socket name_bind;
+	
+')
+
+########################################
+## <summary>
+##	Bind UDP sockets to the salt port.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_udp_bind_salt_port',`
+	gen_require(`
+		type salt_port_t;
+	')
+
+	allow $1 salt_port_t:udp_socket name_bind;
+	
+')
+
+########################################
+## <summary>
+##	Make a TCP connection to the salt port.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`corenet_tcp_connect_salt_port',`
+	gen_require(`
+		type salt_port_t;
+	')
+
+	allow $1 salt_port_t:tcp_socket name_connect;
+')
+
+
+########################################
+## <summary>
+##	Send salt_client packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="write" weight="10"/>
+#
+interface(`corenet_send_salt_client_packets',`
+	gen_require(`
+		type salt_client_packet_t;
+	')
+
+	allow $1 salt_client_packet_t:packet send;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to send salt_client packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_dontaudit_send_salt_client_packets',`
+	gen_require(`
+		type salt_client_packet_t;
+	')
+
+	dontaudit $1 salt_client_packet_t:packet send;
+')
+
+########################################
+## <summary>
+##	Receive salt_client packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="read" weight="10"/>
+#
+interface(`corenet_receive_salt_client_packets',`
+	gen_require(`
+		type salt_client_packet_t;
+	')
+
+	allow $1 salt_client_packet_t:packet recv;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to receive salt_client packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_dontaudit_receive_salt_client_packets',`
+	gen_require(`
+		type salt_client_packet_t;
+	')
+
+	dontaudit $1 salt_client_packet_t:packet recv;
+')
+
+########################################
+## <summary>
+##	Send and receive salt_client packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="both" weight="10"/>
+#
+interface(`corenet_sendrecv_salt_client_packets',`
+	corenet_send_salt_client_packets($1)
+	corenet_receive_salt_client_packets($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to send and receive salt_client packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_dontaudit_sendrecv_salt_client_packets',`
+	corenet_dontaudit_send_salt_client_packets($1)
+	corenet_dontaudit_receive_salt_client_packets($1)
+')
+
+########################################
+## <summary>
+##	Relabel packets to salt_client the packet type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`corenet_relabelto_salt_client_packets',`
+	gen_require(`
+		type salt_client_packet_t;
+	')
+
+	allow $1 salt_client_packet_t:packet relabelto;
+')
+
+
+########################################
+## <summary>
+##	Send salt_server packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="write" weight="10"/>
+#
+interface(`corenet_send_salt_server_packets',`
+	gen_require(`
+		type salt_server_packet_t;
+	')
+
+	allow $1 salt_server_packet_t:packet send;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to send salt_server packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_dontaudit_send_salt_server_packets',`
+	gen_require(`
+		type salt_server_packet_t;
+	')
+
+	dontaudit $1 salt_server_packet_t:packet send;
+')
+
+########################################
+## <summary>
+##	Receive salt_server packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="read" weight="10"/>
+#
+interface(`corenet_receive_salt_server_packets',`
+	gen_require(`
+		type salt_server_packet_t;
+	')
+
+	allow $1 salt_server_packet_t:packet recv;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to receive salt_server packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_dontaudit_receive_salt_server_packets',`
+	gen_require(`
+		type salt_server_packet_t;
+	')
+
+	dontaudit $1 salt_server_packet_t:packet recv;
+')
+
+########################################
+## <summary>
+##	Send and receive salt_server packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <infoflow type="both" weight="10"/>
+#
+interface(`corenet_sendrecv_salt_server_packets',`
+	corenet_send_salt_server_packets($1)
+	corenet_receive_salt_server_packets($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to send and receive salt_server packets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`corenet_dontaudit_sendrecv_salt_server_packets',`
+	corenet_dontaudit_send_salt_server_packets($1)
+	corenet_dontaudit_receive_salt_server_packets($1)
+')
+
+########################################
+## <summary>
+##	Relabel packets to salt_server the packet type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`corenet_relabelto_salt_server_packets',`
+	gen_require(`
+		type salt_server_packet_t;
+	')
+
+	allow $1 salt_server_packet_t:packet relabelto;
+')
+
+
+
+
+########################################
+## <summary>
 ##	Send and receive TCP traffic on the sap port.
 ## </summary>
 ## <param name="domain">