diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te

index 68929b9..3370160 100644

--- a/policy/modules/apps/mozilla.te

+++ b/policy/modules/apps/mozilla.te

@@ -116,6 +116,7 @@ corenet_tcp_sendrecv_http_cache_port(mozilla_t)

 corenet_tcp_sendrecv_squid_port(mozilla_t)

 corenet_tcp_connect_flash_port(mozilla_t)

 corenet_tcp_sendrecv_ftp_port(mozilla_t)

+corenet_tcp_connect_ephemeral_ports(mozilla_t)

 corenet_tcp_sendrecv_ipp_port(mozilla_t)

 corenet_tcp_connect_http_port(mozilla_t)

 corenet_tcp_connect_http_cache_port(mozilla_t)

diff --git a/policy/modules/apps/sandbox.te b/policy/modules/apps/sandbox.te

index 31c02d2..f61ee10 100644

--- a/policy/modules/apps/sandbox.te

+++ b/policy/modules/apps/sandbox.te

@@ -382,6 +382,7 @@ corenet_tcp_connect_http_cache_port(sandbox_web_type)

 corenet_tcp_connect_squid_port(sandbox_web_type)

 corenet_tcp_connect_flash_port(sandbox_web_type)

 corenet_tcp_connect_ftp_port(sandbox_web_type)

+corenet_tcp_connect_ephemeral_ports(sandbox_web_type)

 corenet_tcp_connect_ipp_port(sandbox_web_type)

 corenet_tcp_connect_streaming_port(sandbox_web_type)

 corenet_tcp_connect_pulseaudio_port(sandbox_web_type)

diff --git a/policy/modules/kernel/corenetwork.if.in b/policy/modules/kernel/corenetwork.if.in

index 5a41e58..54e4c81 100644

--- a/policy/modules/kernel/corenetwork.if.in

+++ b/policy/modules/kernel/corenetwork.if.in

@@ -2269,6 +2269,42 @@ interface(`corenet_udp_bind_all_unreserved_ports',`

 ########################################

 ## <summary>

+##	Bind TCP sockets to all ports > 32768.

+## </summary>

+## <param name="domain">

+##	<summary>

+##	Domain allowed access.

+##	</summary>

+## </param>

+#

+interface(`corenet_tcp_bind_all_ephemeral_ports',`

+	gen_require(`

+		attribute ephemeral_port_type;

+	')

+

+	allow $1 ephemeral_port_type:tcp_socket name_bind;

+')

+

+########################################

+## <summary>

+##	Bind UDP sockets to all ports > 32768.

+## </summary>

+## <param name="domain">

+##	<summary>

+##	Domain allowed access.

+##	</summary>

+## </param>

+#

+interface(`corenet_udp_bind_all_ephemeral_ports',`

+	gen_require(`

+		attribute ephemeral_port_type;

+	')

+

+	allow $1 ephemeral_port_type:udp_socket name_bind;

+')

+

+########################################

+## <summary>

 ##	Connect DCCP sockets to reserved ports.

 ## </summary>

 ## <param name="domain">

@@ -2341,6 +2377,24 @@ interface(`corenet_tcp_connect_all_unreserved_ports',`

 ########################################

 ## <summary>

+##	Connect TCP sockets to all ports > 32768.

+## </summary>

+## <param name="domain">

+##	<summary>

+##	Domain allowed access.

+##	</summary>

+## </param>

+#

+interface(`corenet_tcp_connect_all_ephemeral_ports',`

+	gen_require(`

+		attribute ephemeral_port_type;

+	')

+

+	allow $1 ephemeral_port_type:tcp_socket name_connect;

+')

+

+########################################

+## <summary>

 ##	Do not audit attempts to connect DCCP sockets

 ##	all reserved ports.

 ## </summary>

diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in

index 5287f7a..f65fb75 100644

--- a/policy/modules/kernel/corenetwork.te.in

+++ b/policy/modules/kernel/corenetwork.te.in

@@ -14,6 +14,7 @@ attribute port_type;

 attribute defined_port_type;

 attribute reserved_port_type;

 attribute unreserved_port_type;

+attribute ephemeral_port_type;

 attribute rpc_port_type;

 attribute server_packet_type;

@@ -66,11 +67,17 @@ type port_t, port_type;

 sid port gen_context(system_u:object_r:port_t,s0)

 #

-# port_t is the default type of INET port numbers.

+# unreserved_port_t is the default type of port numbers > 1024 and non ephemeral

 #

 type unreserved_port_t, port_type, unreserved_port_type;

 #

+# ephemeral_port_t is the default type of ephemeral port numbers.

+# cat /proc/sys/net/ipv4/ip_local_port_range 

+#

+type ephemeral_port_t, port_type, ephemeral_port_type;

+

+#

 # reserved_port_t is the type of INET port numbers below 1024.

 #

 type reserved_port_t, port_type, reserved_port_type;

@@ -293,9 +300,12 @@ portcon tcp 512-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0)

 portcon udp 512-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0)

 portcon tcp 1-511 gen_context(system_u:object_r:reserved_port_t, s0)

 portcon udp 1-511 gen_context(system_u:object_r:reserved_port_t, s0)

-portcon udp 1024-65535 gen_context(system_u:object_r:unreserved_port_t, s0)

-portcon tcp 1024-65535 gen_context(system_u:object_r:unreserved_port_t, s0)

-

+portcon tcp 1024-32767 gen_context(system_u:object_r:unreserved_port_t, s0)

+portcon tcp 32768-61000 gen_context(system_u:object_r:ephemeral_port_t, s0)

+portcon tcp 61001-65535 gen_context(system_u:object_r:unreserved_port_t, s0)

+portcon udp 1024-32767 gen_context(system_u:object_r:unreserved_port_t, s0)

+portcon udp 32768-61000 gen_context(system_u:object_r:ephemeral_port_t, s0)

+portcon udp 61001-65535 gen_context(system_u:object_r:unreserved_port_t, s0)

 ########################################

 #

 # Network nodes

diff --git a/policy/modules/kernel/corenetwork.te.m4 b/policy/modules/kernel/corenetwork.te.m4

index 49f27ca..e8acd10 100644

--- a/policy/modules/kernel/corenetwork.te.m4

+++ b/policy/modules/kernel/corenetwork.te.m4

@@ -81,7 +81,13 @@ declare_nodes($1_node_t,shift($*))

 define(`declare_ports',`dnl

 ifelse(eval(range_start($3) < 1024),1,`typeattribute $1 reserved_port_type;

 ifelse(eval(range_start($3) >= 512),1,`typeattribute $1 rpc_port_type;',`dnl')

-',`typeattribute $1 unreserved_port_type;')

+',`

+ifelse(eval(range_start($3) < 32768),1,`typeattribute $1 unreserved_port_type;',`

+      ifelse(eval(range_start($3) > 61001),1,`typeattribute $1 unreserved_port_type;',`

+         typeattribute $1 ephemeral_port_type;

+      ')

+   ')

+')

 portcon $2 $3 gen_context(system_u:object_r:$1,$4)

 ifelse(`$5',`',`',`declare_ports($1,shiftn(4,$*))')dnl

 ')

diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te

index 8596b90..9f37c11 100644

--- a/policy/modules/services/apache.te

+++ b/policy/modules/services/apache.te

@@ -137,6 +137,14 @@ gen_tunable(httpd_enable_ftp_server, false)

 ## <desc>

 ##	

+##	Allow httpd to act as a FTP client

+##	connecting to the ftp port and ephemeral ports

+##	

+## </desc>

+gen_tunable(httpd_can_connect_ftp, false)

+

+## <desc>

+##	

 ##	Allow httpd to read home directories

 ##	

 ## </desc>

@@ -583,6 +591,7 @@ tunable_policy(`httpd_can_network_relay',`

 	corenet_sendrecv_http_client_packets(httpd_t)

 	corenet_sendrecv_http_cache_client_packets(httpd_t)

 	corenet_sendrecv_squid_client_packets(httpd_t)

+	corenet_tcp_connect_ephermeral_ports(httpd_t)

 ')

 tunable_policy(`httpd_execmem',`

@@ -621,8 +630,14 @@ tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`

 	manage_lnk_files_pattern(httpd_t, httpdcontent, httpdcontent)

 ')

+tunable_policy(`httpd_can_network_connect_ftp',`

+	corenet_tcp_connect_ftp_port(httpd_t)

+	corenet_tcp_connect_ephemeral_ports(httpd_t)

+')

+

 tunable_policy(`httpd_enable_ftp_server',`

 	corenet_tcp_bind_ftp_port(httpd_t)

+	corenet_tcp_bind_ephemeral_ports(httpd_t)

 ')

 tunable_policy(`httpd_tmp_exec && httpd_builtin_scripting',`

diff --git a/policy/modules/services/cobbler.te b/policy/modules/services/cobbler.te

index 2607914..cb33e76 100644

--- a/policy/modules/services/cobbler.te

+++ b/policy/modules/services/cobbler.te

@@ -110,6 +110,7 @@ corenet_tcp_sendrecv_generic_port(cobblerd_t)

 corenet_tcp_sendrecv_cobbler_port(cobblerd_t)

 # sync and rsync to ftp and http are permitted by default, for any other media use cobbler_can_network_connect.

 corenet_tcp_connect_ftp_port(cobblerd_t)

+corenet_tcp_connect_ephemeral_ports(ftpd_t)

 corenet_tcp_sendrecv_ftp_port(cobblerd_t)

 corenet_sendrecv_ftp_client_packets(cobblerd_t)

 corenet_tcp_connect_http_port(cobblerd_t)

diff --git a/policy/modules/services/ftp.te b/policy/modules/services/ftp.te

index 9a1355e..f807210 100644

--- a/policy/modules/services/ftp.te

+++ b/policy/modules/services/ftp.te

@@ -218,9 +218,8 @@ corenet_tcp_bind_generic_node(ftpd_t)

 corenet_tcp_bind_ftp_port(ftpd_t)

 corenet_tcp_bind_ftp_data_port(ftpd_t)

 corenet_tcp_bind_generic_port(ftpd_t)

-corenet_tcp_bind_all_unreserved_ports(ftpd_t)

-corenet_dontaudit_tcp_bind_all_ports(ftpd_t)

-corenet_tcp_connect_all_ports(ftpd_t)

+corenet_tcp_bind_all_ephemeral_ports(ftpd_t)

+corenet_tcp_connect_all_ephemeral_ports(ftpd_t)

 corenet_sendrecv_ftp_server_packets(ftpd_t)

 domain_use_interactive_fds(ftpd_t)

diff --git a/policy/modules/services/mock.te b/policy/modules/services/mock.te

index 1b9893a..a8eaa4d 100644

--- a/policy/modules/services/mock.te

+++ b/policy/modules/services/mock.te

@@ -87,7 +87,7 @@ corecmd_dontaudit_exec_all_executables(mock_t)

 corenet_tcp_connect_http_port(mock_t)

 corenet_tcp_connect_ftp_port(mock_t)

-corenet_tcp_connect_all_unreserved_ports(mock_t)

+corenet_tcp_connect_ephemeral_ports(mock_t)

 dev_read_urand(mock_t)

 dev_read_sysfs(mock_t)