using firewalld on on debian with selinux

[Mario Koppensteiner <mariok@rantanplan.org>]

Hello debian-firewall List members.

This weekend I did install an Debian GNU/Linux 11 (bullseye) system. 
This system directly connected to the internet and so I try do to 
hardening.

I did enable selinux with the targeted policy on my Debian System. Then 
I did troubleshoot a lot to get firewalld running. I found there are 
some rules missing in the targeted policy.

Here they are:

# cat firewalldcustom1.te

module firewalldcustom1 1.0;

require {
        type firewalld_t;
        type firewalld_etc_rw_t;
        type lib_t;
        type tmpfs_t;
        type unconfined_t;
        class dir watch;
        class dir write;
        class dbus send_msg;
        class file execute;
        class file map;
        class file read;
        class file write;
        class netlink_netfilter_socket create;
        class netlink_netfilter_socket getopt;
        class netlink_netfilter_socket read;
        class netlink_netfilter_socket setopt;
        class netlink_netfilter_socket write;
}

#============= firewalld_t ==============
allow firewalld_t firewalld_etc_rw_t:dir watch;
allow firewalld_t lib_t:dir watch;
allow firewalld_t tmpfs_t:file { execute map read write};
allow firewalld_t tmpfs_t:dir write;
allow firewalld_t self:netlink_netfilter_socket { create getopt read 
setopt write };
allow firewalld_t unconfined_t:dbus send_msg;

#

Now I can start the firewalld. But I can't add any service. If I try to 
add a service, then I get:

# firewall-cmd --add-service=http
Error: COMMAND_FAILED: 'python-nftables' failed: internal:0:0-0: Error: 
Could not process rule: No such file or directory


JSON blob:
{"nftables": [{"metainfo": {"json_schema_version": 1}}, {"add": {"rule": 
{"family": "inet", "table": "firewalld", "chain": 
"filter_IN_public_allow", "expr": [{"match": {"left": {"payload": 
{"protocol": "tcp", "field": "dport"}}, "op": "==", "right": 80}}, 
{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": 
{"set": ["new", "untracked"]}}}, {"accept": null}]}}}]}
#

If I set the selinux mode from enforcing to permissive then it is 
working as expected. So I think it is somehow related to SELinux. But I 
can't find any usefull lines in /var/log/audit/audit.log


What can I do to solve my issue?


sincerely yours

Mario Koppensteiner