Dan Walsh 6a5563
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
Dan Walsh 6a5563
index 68929b9..3370160 100644
Dan Walsh 6a5563
--- a/policy/modules/apps/mozilla.te
Dan Walsh 6a5563
+++ b/policy/modules/apps/mozilla.te
Dan Walsh 6a5563
@@ -116,6 +116,7 @@ corenet_tcp_sendrecv_http_cache_port(mozilla_t)
Dan Walsh 6a5563
 corenet_tcp_sendrecv_squid_port(mozilla_t)
Dan Walsh 6a5563
 corenet_tcp_connect_flash_port(mozilla_t)
Dan Walsh 6a5563
 corenet_tcp_sendrecv_ftp_port(mozilla_t)
Miroslav 37ce30
+corenet_tcp_connect_all_ephemeral_ports(mozilla_t)
Dan Walsh 6a5563
 corenet_tcp_sendrecv_ipp_port(mozilla_t)
Dan Walsh 6a5563
 corenet_tcp_connect_http_port(mozilla_t)
Dan Walsh 6a5563
 corenet_tcp_connect_http_cache_port(mozilla_t)
Dan Walsh 6a5563
diff --git a/policy/modules/apps/sandbox.te b/policy/modules/apps/sandbox.te
Dan Walsh 6a5563
index 31c02d2..f61ee10 100644
Dan Walsh 6a5563
--- a/policy/modules/apps/sandbox.te
Dan Walsh 6a5563
+++ b/policy/modules/apps/sandbox.te
Dan Walsh 6a5563
@@ -382,6 +382,7 @@ corenet_tcp_connect_http_cache_port(sandbox_web_type)
Dan Walsh 6a5563
 corenet_tcp_connect_squid_port(sandbox_web_type)
Dan Walsh 6a5563
 corenet_tcp_connect_flash_port(sandbox_web_type)
Dan Walsh 6a5563
 corenet_tcp_connect_ftp_port(sandbox_web_type)
Miroslav 37ce30
+corenet_tcp_connect_all_ephemeral_ports(sandbox_web_type)
Dan Walsh 6a5563
 corenet_tcp_connect_ipp_port(sandbox_web_type)
Dan Walsh 6a5563
 corenet_tcp_connect_streaming_port(sandbox_web_type)
Dan Walsh 6a5563
 corenet_tcp_connect_pulseaudio_port(sandbox_web_type)
Dan Walsh 6a5563
diff --git a/policy/modules/kernel/corenetwork.if.in b/policy/modules/kernel/corenetwork.if.in
Dan Walsh 6a5563
index 5a41e58..54e4c81 100644
Dan Walsh 6a5563
--- a/policy/modules/kernel/corenetwork.if.in
Dan Walsh 6a5563
+++ b/policy/modules/kernel/corenetwork.if.in
Dan Walsh 6a5563
@@ -2269,6 +2269,42 @@ interface(`corenet_udp_bind_all_unreserved_ports',`
Dan Walsh 6a5563
 
Dan Walsh 6a5563
 ########################################
Dan Walsh 6a5563
 ## <summary>
Dan Walsh 6a5563
+##	Bind TCP sockets to all ports > 32768.
Dan Walsh 6a5563
+## </summary>
Dan Walsh 6a5563
+## <param name="domain">
Dan Walsh 6a5563
+##	<summary>
Dan Walsh 6a5563
+##	Domain allowed access.
Dan Walsh 6a5563
+##	</summary>
Dan Walsh 6a5563
+## </param>
Dan Walsh 6a5563
+#
Dan Walsh 6a5563
+interface(`corenet_tcp_bind_all_ephemeral_ports',`
Dan Walsh 6a5563
+	gen_require(`
Dan Walsh 6a5563
+		attribute ephemeral_port_type;
Dan Walsh 6a5563
+	')
Dan Walsh 6a5563
+
Dan Walsh 6a5563
+	allow $1 ephemeral_port_type:tcp_socket name_bind;
Dan Walsh 6a5563
+')
Dan Walsh 6a5563
+
Dan Walsh 6a5563
+########################################
Dan Walsh 6a5563
+## <summary>
Dan Walsh 6a5563
+##	Bind UDP sockets to all ports > 32768.
Dan Walsh 6a5563
+## </summary>
Dan Walsh 6a5563
+## <param name="domain">
Dan Walsh 6a5563
+##	<summary>
Dan Walsh 6a5563
+##	Domain allowed access.
Dan Walsh 6a5563
+##	</summary>
Dan Walsh 6a5563
+## </param>
Dan Walsh 6a5563
+#
Dan Walsh 6a5563
+interface(`corenet_udp_bind_all_ephemeral_ports',`
Dan Walsh 6a5563
+	gen_require(`
Dan Walsh 6a5563
+		attribute ephemeral_port_type;
Dan Walsh 6a5563
+	')
Dan Walsh 6a5563
+
Dan Walsh 6a5563
+	allow $1 ephemeral_port_type:udp_socket name_bind;
Dan Walsh 6a5563
+')
Dan Walsh 6a5563
+
Dan Walsh 6a5563
+########################################
Dan Walsh 6a5563
+## <summary>
Dan Walsh 6a5563
 ##	Connect DCCP sockets to reserved ports.
Dan Walsh 6a5563
 ## </summary>
Dan Walsh 6a5563
 ## <param name="domain">
Dan Walsh 6a5563
@@ -2341,6 +2377,24 @@ interface(`corenet_tcp_connect_all_unreserved_ports',`
Dan Walsh 6a5563
 
Dan Walsh 6a5563
 ########################################
Dan Walsh 6a5563
 ## <summary>
Dan Walsh 6a5563
+##	Connect TCP sockets to all ports > 32768.
Dan Walsh 6a5563
+## </summary>
Dan Walsh 6a5563
+## <param name="domain">
Dan Walsh 6a5563
+##	<summary>
Dan Walsh 6a5563
+##	Domain allowed access.
Dan Walsh 6a5563
+##	</summary>
Dan Walsh 6a5563
+## </param>
Dan Walsh 6a5563
+#
Dan Walsh 6a5563
+interface(`corenet_tcp_connect_all_ephemeral_ports',`
Dan Walsh 6a5563
+	gen_require(`
Dan Walsh 6a5563
+		attribute ephemeral_port_type;
Dan Walsh 6a5563
+	')
Dan Walsh 6a5563
+
Dan Walsh 6a5563
+	allow $1 ephemeral_port_type:tcp_socket name_connect;
Dan Walsh 6a5563
+')
Dan Walsh 6a5563
+
Dan Walsh 6a5563
+########################################
Dan Walsh 6a5563
+## <summary>
Dan Walsh 6a5563
 ##	Do not audit attempts to connect DCCP sockets
Dan Walsh 6a5563
 ##	all reserved ports.
Dan Walsh 6a5563
 ## </summary>
Dan Walsh 24b80b
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
Dan Walsh 6a5563
index 5287f7a..f65fb75 100644
Dan Walsh 24b80b
--- a/policy/modules/kernel/corenetwork.te.in
Dan Walsh 24b80b
+++ b/policy/modules/kernel/corenetwork.te.in
Dan Walsh 6a5563
@@ -14,6 +14,7 @@ attribute port_type;
Dan Walsh 6a5563
 attribute defined_port_type;
Dan Walsh 6a5563
 attribute reserved_port_type;
Dan Walsh 6a5563
 attribute unreserved_port_type;
Dan Walsh 6a5563
+attribute ephemeral_port_type;
Dan Walsh 6a5563
 attribute rpc_port_type;
Dan Walsh 6a5563
 attribute server_packet_type;
Dan Walsh 6a5563
 
Dan Walsh 6a5563
@@ -66,11 +67,17 @@ type port_t, port_type;
Dan Walsh 24b80b
 sid port gen_context(system_u:object_r:port_t,s0)
Dan Walsh 24b80b
 
Dan Walsh 24b80b
 #
Dan Walsh 24b80b
-# port_t is the default type of INET port numbers.
Dan Walsh 24b80b
+# unreserved_port_t is the default type of port numbers > 1024 and non ephemeral
Dan Walsh 24b80b
 #
Dan Walsh 24b80b
 type unreserved_port_t, port_type, unreserved_port_type;
Dan Walsh 24b80b
 
Dan Walsh 24b80b
 #
Dan Walsh 24b80b
+# ephemeral_port_t is the default type of ephemeral port numbers.
Dan Walsh 24b80b
+# cat /proc/sys/net/ipv4/ip_local_port_range 
Dan Walsh 24b80b
+#
Dan Walsh 6a5563
+type ephemeral_port_t, port_type, ephemeral_port_type;
Dan Walsh 24b80b
+
Dan Walsh 24b80b
+#
Dan Walsh 24b80b
 # reserved_port_t is the type of INET port numbers below 1024.
Dan Walsh 24b80b
 #
Dan Walsh 24b80b
 type reserved_port_t, port_type, reserved_port_type;
Dan Walsh 6a5563
@@ -293,9 +300,12 @@ portcon tcp 512-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0)
Dan Walsh 24b80b
 portcon udp 512-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0)
Dan Walsh 24b80b
 portcon tcp 1-511 gen_context(system_u:object_r:reserved_port_t, s0)
Dan Walsh 24b80b
 portcon udp 1-511 gen_context(system_u:object_r:reserved_port_t, s0)
Dan Walsh 24b80b
-portcon udp 1024-65535 gen_context(system_u:object_r:unreserved_port_t, s0)
Dan Walsh 24b80b
-portcon tcp 1024-65535 gen_context(system_u:object_r:unreserved_port_t, s0)
Dan Walsh 24b80b
-
Dan Walsh 24b80b
+portcon tcp 1024-32767 gen_context(system_u:object_r:unreserved_port_t, s0)
Dan Walsh 24b80b
+portcon tcp 32768-61000 gen_context(system_u:object_r:ephemeral_port_t, s0)
Dan Walsh 24b80b
+portcon tcp 61001-65535 gen_context(system_u:object_r:unreserved_port_t, s0)
Dan Walsh 24b80b
+portcon udp 1024-32767 gen_context(system_u:object_r:unreserved_port_t, s0)
Dan Walsh 24b80b
+portcon udp 32768-61000 gen_context(system_u:object_r:ephemeral_port_t, s0)
Miroslav 988dae
+portcon udp 61001-65535 gen_context(system_u:object_r:unreserved_port_t, s0)
Dan Walsh 24b80b
 ########################################
Dan Walsh 24b80b
 #
Dan Walsh 24b80b
 # Network nodes
Dan Walsh 6a5563
diff --git a/policy/modules/kernel/corenetwork.te.m4 b/policy/modules/kernel/corenetwork.te.m4
Dan Walsh 6a5563
index 49f27ca..e8acd10 100644
Dan Walsh 6a5563
--- a/policy/modules/kernel/corenetwork.te.m4
Dan Walsh 6a5563
+++ b/policy/modules/kernel/corenetwork.te.m4
Dan Walsh 6a5563
@@ -81,7 +81,13 @@ declare_nodes($1_node_t,shift($*))
Dan Walsh 6a5563
 define(`declare_ports',`dnl
Dan Walsh 6a5563
 ifelse(eval(range_start($3) < 1024),1,`typeattribute $1 reserved_port_type;
Dan Walsh 6a5563
 ifelse(eval(range_start($3) >= 512),1,`typeattribute $1 rpc_port_type;',`dnl')
Dan Walsh 6a5563
-',`typeattribute $1 unreserved_port_type;')
Dan Walsh 6a5563
+',`
Dan Walsh 6a5563
+ifelse(eval(range_start($3) < 32768),1,`typeattribute $1 unreserved_port_type;',`
Dan Walsh 6a5563
+      ifelse(eval(range_start($3) > 61001),1,`typeattribute $1 unreserved_port_type;',`
Dan Walsh 6a5563
+         typeattribute $1 ephemeral_port_type;
Dan Walsh 6a5563
+      ')
Dan Walsh 6a5563
+   ')
Dan Walsh 6a5563
+')
Dan Walsh 6a5563
 portcon $2 $3 gen_context(system_u:object_r:$1,$4)
Dan Walsh 6a5563
 ifelse(`$5',`',`',`declare_ports($1,shiftn(4,$*))')dnl
Dan Walsh 6a5563
 ')
Dan Walsh 6a5563
diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te
Dan Walsh 6a5563
index 8596b90..9f37c11 100644
Dan Walsh 6a5563
--- a/policy/modules/services/apache.te
Dan Walsh 6a5563
+++ b/policy/modules/services/apache.te
Dan Walsh 6a5563
@@ -137,6 +137,14 @@ gen_tunable(httpd_enable_ftp_server, false)
Dan Walsh 6a5563
 
Dan Walsh 6a5563
 ## <desc>
Dan Walsh 6a5563
 ##	

Dan Walsh 6a5563
+##	Allow httpd to act as a FTP client
Dan Walsh 6a5563
+##	connecting to the ftp port and ephemeral ports
Dan Walsh 6a5563
+##	

Dan Walsh 6a5563
+## </desc>
Dan Walsh 6a5563
+gen_tunable(httpd_can_connect_ftp, false)
Dan Walsh 6a5563
+
Dan Walsh 6a5563
+## <desc>
Dan Walsh 6a5563
+##	

Dan Walsh 6a5563
 ##	Allow httpd to read home directories
Dan Walsh 6a5563
 ##	

Dan Walsh 6a5563
 ## </desc>
Dan Walsh 6a5563
@@ -583,6 +591,7 @@ tunable_policy(`httpd_can_network_relay',`
Dan Walsh 6a5563
 	corenet_sendrecv_http_client_packets(httpd_t)
Dan Walsh 6a5563
 	corenet_sendrecv_http_cache_client_packets(httpd_t)
Dan Walsh 6a5563
 	corenet_sendrecv_squid_client_packets(httpd_t)
Miroslav 37ce30
+	corenet_tcp_connect_all_ephemeral_ports(httpd_t)
Dan Walsh 6a5563
 ')
Dan Walsh 6a5563
 
Dan Walsh 6a5563
 tunable_policy(`httpd_execmem',`
Dan Walsh 6a5563
@@ -621,8 +630,14 @@ tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`
Dan Walsh 6a5563
 	manage_lnk_files_pattern(httpd_t, httpdcontent, httpdcontent)
Dan Walsh 6a5563
 ')
Dan Walsh 6a5563
 
Miroslav b8a4bf
+tunable_policy(`httpd_can_connect_ftp',`
Dan Walsh 6a5563
+	corenet_tcp_connect_ftp_port(httpd_t)
Miroslav 37ce30
+	corenet_tcp_connect_all_ephemeral_ports(httpd_t)
Dan Walsh 6a5563
+')
Dan Walsh 6a5563
+
Dan Walsh 6a5563
 tunable_policy(`httpd_enable_ftp_server',`
Dan Walsh 6a5563
 	corenet_tcp_bind_ftp_port(httpd_t)
Miroslav 99d7cc
+	corenet_tcp_bind_all_ephemeral_ports(httpd_t)
Dan Walsh 6a5563
 ')
Dan Walsh 6a5563
 
Dan Walsh 6a5563
 tunable_policy(`httpd_tmp_exec && httpd_builtin_scripting',`
Dan Walsh 6a5563
diff --git a/policy/modules/services/cobbler.te b/policy/modules/services/cobbler.te
Dan Walsh 6a5563
index 2607914..cb33e76 100644
Dan Walsh 6a5563
--- a/policy/modules/services/cobbler.te
Dan Walsh 6a5563
+++ b/policy/modules/services/cobbler.te
Dan Walsh 6a5563
@@ -110,6 +110,7 @@ corenet_tcp_sendrecv_generic_port(cobblerd_t)
Dan Walsh 6a5563
 corenet_tcp_sendrecv_cobbler_port(cobblerd_t)
Dan Walsh 6a5563
 # sync and rsync to ftp and http are permitted by default, for any other media use cobbler_can_network_connect.
Dan Walsh 6a5563
 corenet_tcp_connect_ftp_port(cobblerd_t)
Miroslav 69cf5b
+corenet_tcp_connect_all_ephemeral_ports(cobblerd_t)
Dan Walsh 6a5563
 corenet_tcp_sendrecv_ftp_port(cobblerd_t)
Dan Walsh 6a5563
 corenet_sendrecv_ftp_client_packets(cobblerd_t)
Dan Walsh 6a5563
 corenet_tcp_connect_http_port(cobblerd_t)
Dan Walsh 6a5563
diff --git a/policy/modules/services/ftp.te b/policy/modules/services/ftp.te
Dan Walsh 6a5563
index 9a1355e..f807210 100644
Dan Walsh 6a5563
--- a/policy/modules/services/ftp.te
Dan Walsh 6a5563
+++ b/policy/modules/services/ftp.te
Dan Walsh 6a5563
@@ -218,9 +218,8 @@ corenet_tcp_bind_generic_node(ftpd_t)
Dan Walsh 6a5563
 corenet_tcp_bind_ftp_port(ftpd_t)
Dan Walsh 6a5563
 corenet_tcp_bind_ftp_data_port(ftpd_t)
Dan Walsh 6a5563
 corenet_tcp_bind_generic_port(ftpd_t)
Dan Walsh 6a5563
-corenet_tcp_bind_all_unreserved_ports(ftpd_t)
Dan Walsh 6a5563
-corenet_dontaudit_tcp_bind_all_ports(ftpd_t)
Dan Walsh 6a5563
-corenet_tcp_connect_all_ports(ftpd_t)
Dan Walsh 6a5563
+corenet_tcp_bind_all_ephemeral_ports(ftpd_t)
Dan Walsh 6a5563
+corenet_tcp_connect_all_ephemeral_ports(ftpd_t)
Dan Walsh 6a5563
 corenet_sendrecv_ftp_server_packets(ftpd_t)
Dan Walsh 6a5563
 
Dan Walsh 6a5563
 domain_use_interactive_fds(ftpd_t)
Dan Walsh 6a5563
diff --git a/policy/modules/services/mock.te b/policy/modules/services/mock.te
Dan Walsh 6a5563
index 1b9893a..a8eaa4d 100644
Dan Walsh 6a5563
--- a/policy/modules/services/mock.te
Dan Walsh 6a5563
+++ b/policy/modules/services/mock.te
Dan Walsh 6a5563
@@ -87,7 +87,7 @@ corecmd_dontaudit_exec_all_executables(mock_t)
Dan Walsh 6a5563
 
Dan Walsh 6a5563
 corenet_tcp_connect_http_port(mock_t)
Dan Walsh 6a5563
 corenet_tcp_connect_ftp_port(mock_t)
Dan Walsh 6a5563
-corenet_tcp_connect_all_unreserved_ports(mock_t)
Miroslav 37ce30
+corenet_tcp_connect_all_ephemeral_ports(mock_t)
Dan Walsh 6a5563
 
Dan Walsh 6a5563
 dev_read_urand(mock_t)
Dan Walsh 6a5563
 dev_read_sysfs(mock_t)