#DESC Zebra - BGP server

#

# Author:  Russell Coker <russell@coker.com.au>

# X-Debian-Packages: zebra

#

type zebra_port_t, port_type;

daemon_domain(zebra, `, sysctl_net_writer')

type zebra_conf_t, file_type, sysadmfile;

r_dir_file({ initrc_t zebra_t }, zebra_conf_t)

can_network_server(zebra_t)

can_ypbind(zebra_t)

allow zebra_t { etc_t etc_runtime_t }:file { getattr read };

allow zebra_t self:process setcap;

allow zebra_t self:capability { setgid setuid net_bind_service net_admin net_raw };

file_type_auto_trans(zebra_t, var_run_t, zebra_var_run_t, sock_file)

logdir_domain(zebra)

# /tmp/.bgpd is such a bad idea!

tmp_domain(zebra, `', sock_file)

allow zebra_t self:unix_dgram_socket create_socket_perms;

allow zebra_t self:unix_stream_socket { connectto create_stream_socket_perms };

allow zebra_t self:rawip_socket create_socket_perms;

allow zebra_t self:netlink_route_socket r_netlink_socket_perms;

allow zebra_t zebra_port_t:tcp_socket name_bind;

allow zebra_t proc_t:file { getattr read };

allow zebra_t { sysctl_t sysctl_net_t }:dir search;

allow zebra_t sysctl_net_t:file rw_file_perms;