firewalld.lockdown-whitelist(5) [centos man page]

FIREWALLD.LOCKDOWN(5)					   firewalld.lockdown-whitelist 				     FIREWALLD.LOCKDOWN(5)

NAME

       firewalld.lockdown-whitelist - firewalld lockdown whitelist configuration file

SYNOPSIS

       /etc/firewalld/lockdown-whitelists.xml

DESCRIPTION

       The firewalld lockdown-whitelist configuration file contains the selinux contexts, commands, users and user ids that are white-listed when
       firewalld lockdown feature is enabled (see firewalld.conf(5) and firewall-cmd(1)).

       This example configuration file shows the structure of an lockdown-whitelist file:

	   <?xml version="1.0" encoding="utf-8"?>
	   <whitelist>
	     <selinux context="selinuxcontext"/>
	     <command name="commandline[*]"/>
	     <user {name="username|id="userid"}/>
	   </whitelist>

OPTIONS

       The config can contain these tags and attributes. Some of them are mandatory, others optional.

   whitelist
       The mandatory whitelist start and end tag defines the lockdown-whitelist. This tag can only be used once in a lockdown-whitelist
       configuration file. There are no attributes for this.

   selinux
       Is an optional empty-element tag and can be used several times to have more than one selinux contexts entries. A selinux entry has exactly
       one attribute:

       context="string"
	   The context is the security (SELinux) context of a running application or service.

	   To get the context of a running application use ps -e --context and search for the application that should be white-listed.

	   Warning: If the context of an application is unconfined, then this will open access for more than the desired application.

   command
       Is an optional empty-element tag and can be used several times to have more than one command entry. A command entry has exactly one
       attribute:

       name="string"
	   The command string is a complete command line including path and also attributes.

	   If a command entry ends with an asterisk '*', then all command lines starting with the command will match. If the '*' is not there the
	   absolute command inclusive arguments must match.

	   Commands for user root and others is not always the same, the used path depends on the use of the PATH environment variable.

   user
       Is an optional empty-element tag and can be used several times to white-list more than one user. A user entry has exactly one attribute of
       these:

       name="string"
	   The user with the name string will be white-listed.

       id="integer"
	   The user with the id userid will be white-listed.

SEE ALSO

       firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1), firewalld.conf(5), firewalld.direct(5), firewalld.icmptype(5),
       firewalld.lockdown-whitelist(5), firewall-offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5), firewalld.zone(5),
       firewalld.zones(5)

NOTES

       firewalld home page at fedorahosted.org:
	   http://fedorahosted.org/firewalld/

       More documentation with examples:
	   http://fedoraproject.org/wiki/FirewallD

AUTHORS

       Thomas Woerner <twoerner@redhat.com>
	   Developer

       Jiri Popelka <jpopelka@redhat.com>
	   Developer

firewalld 0.3.9 													     FIREWALLD.LOCKDOWN(5)

FIREWALLD.ZONE(5)						  firewalld.zone						 FIREWALLD.ZONE(5)

NAME

       firewalld.zone - firewalld zone configuration files

SYNOPSIS

       /etc/firewalld/zones/zone.xml
       /usr/lib/firewalld/zones/zone.xml

DESCRIPTION

       A firewalld zone configuration file contains the information for a zone. These are the zone description, services, ports, icmp-blocks,
       masquerade, forward-ports and rich language rules in an XML file format. The file name has to be zone_name.xml where length of zone_name is
       currently limited to 17 chars.

       This is the structure of a zone configuration file:

	   <?xml version="1.0" encoding="utf-8"?>
	   <zone [version="versionstring"] [target="ACCEPT|%%REJECT%%|DROP"]>
	     [ <short>short description</short> ]
	     [ <description>description</description> ]
	     [ <interface name="string"/> ]
	     [ <source address="address[/mask]"/> ]
	     [ <service name="string"/> ]
	     [ <port port="portid[-portid]" protocol="tcp|udp"/> ]
	     [ <icmp-block name="string"/> ]
	     [ <masquerade/> ]
	     [ <forward-port port="portid[-portid]" protocol="tcp|udp" [to-port="portid[-portid]"] [to-addr="ipv4address"]/> ]
	     [
	       <rule [family="ipv4|ipv6"]>
	       [ <source address="address[/mask]" [invert="bool"]/> ]
	       [ <destination address="address[/mask]" [invert="bool"]/> ]
	       [
		 <service name="string"/> |
		 <port port="portid[-portid]" protocol="tcp|udp"/> |
		 <protocol value="protocol"/> |
		 <icmp-block name="icmptype"/> |
		 <masquerade/> |
		 <forward-port port="portid[-portid]" protocol="tcp|udp" [to-port="portid[-portid]"] [to-addr="address"]/>
	       ]
	       [ <log [prefix="prefixtext"] [level="emerg|alert|crit|err|warn|notice|info|debug"]/> [<limit value="rate/duration"/>] </log> ]
	       [ <audit> [<limit value="rate/duration"/>] </audit> ]
	       [ <accept/> | <reject [type="rejecttype"]/> | <drop/> ]
	       </rule>
	     ]
	   </zone>

       The config can contain these tags and attributes. Some of them are mandatory, others optional.

   zone
       The mandatory zone start and end tag defines the zone. This tag can only be used once in a zone configuration file. There are optional
       attributes for zones:

       version="string"
	   To give the zone a version.

       target="ACCEPT|%%REJECT%%|DROP"
	   Can be used to accept, reject or drop every packet. The ACCEPT target is used in the trusted zone, every packet will be accepted. The
	   %%REJECT%% target is used in the block zone, every packet will be rejected with the default firewalld reject type. The DROP target is
	   used in the drop zone, every packet will be dropped. The default target is {chain}_ZONE_{zone} and will be used if the target is not
	   specified. If other than the default target is used, all settings except interface and source are ignored, because the first rule
	   created in firewall for this zone is 'jump to target'.

   short
       Is an optional start and end tag and is used to give a zone a more readable name.

   description
       Is an optional start and end tag to have a description for a zone.

   interface
       Is an optional empty-element tag and can be used several times. It can be used to bind an interface to a zone. An interface entry has
       exactly one attribute:

       name="string"
	   The name of the interface to be bound to the zone.

   source
       Is an optional empty-element tag and can be used several times. It can be used to bind a source address or source address range to a zone.
       A source entry has exactly one attribute:

       address="address[/mask]"
	   The source to be bound to the zone. The source is either an IP address or a network IP address with a mask for IPv4 or IPv6. The
	   network family (IPv4/IPv6) will be automatically discovered. For IPv4, the mask can be a network mask or a plain number. For IPv6 the
	   mask is a plain number. The use of host names is not supported.

   service
       Is an optional empty-element tag and can be used several times to have more than one service entry enabled. A service entry has exactly one
       attribute:

       name="string"
	   The name of the service to be enabled. To get a list of valid service names firewall-cmd --list=services can be used.

   port
       Is an optional empty-element tag and can be used several times to have more than one port entry. All attributes of a port entry are
       mandatory:

       port="portid[-portid]"
	   The port can either be a single port number portid or a port range portid-portid.

       protocol="tcp|udp"
	   The protocol can either be tcp or udp.

   icmp-block
       Is an optional empty-element tag and can be used several times to have more than one icmp-block entry. Each icmp-block tag has exactly one
       mandatory attribute:

       name="string"
	   The name of the Internet Control Message Protocol (ICMP) type to be blocked. To get a list of valid ICMP types firewall-cmd
	   --list=icmptypes can be used.

   masquerade
       Is an optional empty-element tag. It can be used only once in a zone configuration and is not usable for IPv6. If it's present masquerading
       is enabled for the zone. If you want to enable masquerading, you should enable it in the zone bound to the external interface.

   forward-port
       Is an optional empty-element tag and can be used several times to have more than one port or packet forward entry. This is for IPv4 only.
       Use rich language rules for IPv6. There are mandatory and also optional attributes for forward ports:

       Mandatory attributes:
	   The local port and protocol to be forwarded.

	   port="portid[-portid]"
	       The port can either be a single port number portid or a port range portid-portid.

	   protocol="tcp|udp"
	       The protocol can either be tcp or udp.

       Optional attributes:
	   The destination of the forward. For local forwarding add to-port only. For remote forwarding add to-addr and use to-port optionally if
	   the destination port on the destination machine should be different.

	   to-port="portid[-portid]"
	       The destination port or port range to forward to. If omitted, the value of the port= attribute will be used altogether with the
	       to-addr attribute.

	   to-addr="address"
	       The destination IPv4 IP address.

   rule
       Is an optional element tag and can be used several times to have more than one rich language rule entry.

       The general rule structure:

	   <rule [family="ipv4|ipv6"]/>
	     [ <source address="address[/mask]" [invert="bool"]/> ]
	     [ <destination address="address[/mask]" [invert="bool"]/> ]
	     [
	       <service name="string"/> |
	       <port port="portid[-portid]" protocol="tcp|udp"/> |
	       <protocol value="protocol"/> |
	       <icmp-block name="icmptype"/> |
	       <masquerade/> |
	       <forward-port port="portid[-portid]" protocol="tcp|udp" [to-port="portid[-portid]"] [to-addr="address"]/>
	     ]
	     [ <log [prefix="prefixtext"] [level="emerg|alert|crit|err|warn|notice|info|debug"]/> [<limit value="rate/duration"/>] </log> ]
	     [ <audit> [<limit value="rate/duration"/>] </audit> ]
	     [ <accept/> | <reject [type="rejecttype"]/> | <drop/> ]
	   </rule>

       Rule structure for source black or white listing:

	   <rule [family="ipv4|ipv6"]/>
	     <source address="address[/mask]" [family="bool"]/>
	     [ <log [prefix="prefixtext"] [level="emerg|alert|crit|err|warn|notice|info|debug"]/> [<limit value="rate/duration"/>] </log> ]
	     [ <audit> [<limit value="rate/duration"/>] </audit> ]
	     <accept/> | <reject [type="rejecttype"]/> | <drop/>
	   </rule>

       For a full description on rich language rules, please have a look at firewalld.richlanguage(5).

SEE ALSO

       firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1), firewalld.conf(5), firewalld.direct(5), firewalld.icmptype(5),
       firewalld.lockdown-whitelist(5), firewall-offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5), firewalld.zone(5),
       firewalld.zones(5)

NOTES

       firewalld home page at fedorahosted.org:
	   http://fedorahosted.org/firewalld/

       More documentation with examples:
	   http://fedoraproject.org/wiki/FirewallD

AUTHORS

       Thomas Woerner <twoerner@redhat.com>
	   Developer

       Jiri Popelka <jpopelka@redhat.com>
	   Developer

firewalld 0.3.9 														 FIREWALLD.ZONE(5)