RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix superfluous network rules pointed out by dan walsh, and clean

This commit is contained in:
Chris PeBenito 2005-11-18 15:53:34 +00:00
parent 704327e8b2
commit 1354ca04a6
1 changed files with 3 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
refpolicy/policy/modules/services/zebra.te
View File

@ -29,12 +29,12 @@ files_pid_file(zebra_var_run_t)
allow zebra_t self:capability { setgid setuid net_admin net_raw net_bind_service };
dontaudit zebra_t self:capability sys_tty_config;
allow zebra_t self:process setcap;
allow zebra_t self:process { signal_perms setcap };
allow zebra_t self:file { ioctl read write getattr lock append };
allow zebra_t self:unix_dgram_socket create_socket_perms;
allow zebra_t self:unix_stream_socket { connectto create_stream_socket_perms };
allow zebra_t self:netlink_route_socket r_netlink_socket_perms;
allow zebra_t self:tcp_socket create_stream_socket_perms;
allow zebra_t self:tcp_socket connected_stream_socket_perms;
allow zebra_t self:udp_socket create_socket_perms;
allow zebra_t self:rawip_socket create_socket_perms;
@ -44,7 +44,7 @@ allow zebra_t zebra_conf_t:lnk_file { getattr read };
allow zebra_t zebra_log_t:file create_file_perms;
allow zebra_t zebra_log_t:sock_file create_file_perms;
allow zebra_t zebra_log_t:dir rw_dir_perms;
allow zebra_t zebra_log_t:dir { rw_dir_perms setattr };
logging_create_log(zebra_t,zebra_log_t,{ sock_file file dir })
# /tmp/.bgpd is such a bad idea!
@ -72,13 +72,10 @@ corenet_udp_sendrecv_all_ports(zebra_t)
corenet_tcp_bind_all_nodes(zebra_t)
corenet_udp_bind_all_nodes(zebra_t)
corenet_tcp_bind_zebra_port(zebra_t)
corenet_tcp_bind_all_reserved_ports(zebra_t)
corenet_tcp_connect_all_reserved_ports(zebra_t)
dev_associate_usbfs(zebra_var_run_t)
dev_list_all_dev_nodes(zebra_t)
dev_read_sysfs(zebra_t)
dev_read_sysfs(zebra_tmp_t)
dev_rw_zero_dev(zebra_t)
fs_getattr_all_fs(zebra_t)