34 lines
1.1 KiB
Plaintext
34 lines
1.1 KiB
Plaintext
|
#DESC Zebra - BGP server
|
||
|
|
#
|
||
|
|
# Author: Russell Coker <russell@coker.com.au>
|
||
|
|
# X-Debian-Packages: zebra
|
||
|
|
#
|
||
|
|
type zebra_port_t, port_type;
|
||
|
|
|
||
|
|
daemon_domain(zebra, `, sysctl_net_writer')
|
||
|
|
type zebra_conf_t, file_type, sysadmfile;
|
||
|
|
r_dir_file({ initrc_t zebra_t }, zebra_conf_t)
|
||
|
|
|
||
|
|
can_network_server(zebra_t)
|
||
|
|
can_ypbind(zebra_t)
|
||
|
|
allow zebra_t { etc_t etc_runtime_t }:file { getattr read };
|
||
|
|
|
||
|
|
allow zebra_t self:process setcap;
|
||
|
|
allow zebra_t self:capability { setgid setuid net_bind_service net_admin net_raw };
|
||
|
|
file_type_auto_trans(zebra_t, var_run_t, zebra_var_run_t, sock_file)
|
||
|
|
|
||
|
|
logdir_domain(zebra)
|
||
|
|
|
||
|
|
# /tmp/.bgpd is such a bad idea!
|
||
|
|
tmp_domain(zebra, `', sock_file)
|
||
|
|
|
||
|
|
allow zebra_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
allow zebra_t self:unix_stream_socket { connectto create_stream_socket_perms };
|
||
|
|
allow zebra_t self:rawip_socket create_socket_perms;
|
||
|
|
allow zebra_t self:netlink_route_socket r_netlink_socket_perms;
|
||
|
|
allow zebra_t zebra_port_t:tcp_socket name_bind;
|
||
|
|
|
||
|
|
allow zebra_t proc_t:file { getattr read };
|
||
|
|
allow zebra_t { sysctl_t sysctl_net_t }:dir search;
|
||
|
|
allow zebra_t sysctl_net_t:file rw_file_perms;
|