From 1354ca04a611fe3d419b274e8844d48ae89a6c2c Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Nov 18 2005 15:53:34 +0000 Subject: fix superfluous network rules pointed out by dan walsh, and clean --- diff --git a/refpolicy/policy/modules/services/zebra.te b/refpolicy/policy/modules/services/zebra.te index 6d6c5f2..615f6a2 100644 --- a/refpolicy/policy/modules/services/zebra.te +++ b/refpolicy/policy/modules/services/zebra.te @@ -29,12 +29,12 @@ files_pid_file(zebra_var_run_t) allow zebra_t self:capability { setgid setuid net_admin net_raw net_bind_service }; dontaudit zebra_t self:capability sys_tty_config; -allow zebra_t self:process setcap; +allow zebra_t self:process { signal_perms setcap }; allow zebra_t self:file { ioctl read write getattr lock append }; allow zebra_t self:unix_dgram_socket create_socket_perms; allow zebra_t self:unix_stream_socket { connectto create_stream_socket_perms }; allow zebra_t self:netlink_route_socket r_netlink_socket_perms; -allow zebra_t self:tcp_socket create_stream_socket_perms; +allow zebra_t self:tcp_socket connected_stream_socket_perms; allow zebra_t self:udp_socket create_socket_perms; allow zebra_t self:rawip_socket create_socket_perms; @@ -44,7 +44,7 @@ allow zebra_t zebra_conf_t:lnk_file { getattr read }; allow zebra_t zebra_log_t:file create_file_perms; allow zebra_t zebra_log_t:sock_file create_file_perms; -allow zebra_t zebra_log_t:dir rw_dir_perms; +allow zebra_t zebra_log_t:dir { rw_dir_perms setattr }; logging_create_log(zebra_t,zebra_log_t,{ sock_file file dir }) # /tmp/.bgpd is such a bad idea! @@ -72,13 +72,10 @@ corenet_udp_sendrecv_all_ports(zebra_t) corenet_tcp_bind_all_nodes(zebra_t) corenet_udp_bind_all_nodes(zebra_t) corenet_tcp_bind_zebra_port(zebra_t) -corenet_tcp_bind_all_reserved_ports(zebra_t) -corenet_tcp_connect_all_reserved_ports(zebra_t) dev_associate_usbfs(zebra_var_run_t) dev_list_all_dev_nodes(zebra_t) dev_read_sysfs(zebra_t) -dev_read_sysfs(zebra_tmp_t) dev_rw_zero_dev(zebra_t) fs_getattr_all_fs(zebra_t)