#DESC Zebra - BGP server
#
# Author:  Russell Coker <russell@coker.com.au>
# X-Debian-Packages: zebra
#

daemon_domain(zebra, `, sysctl_net_writer')
type zebra_conf_t, file_type, sysadmfile;
r_dir_file({ initrc_t zebra_t }, zebra_conf_t)

can_network_server(zebra_t)
can_ypbind(zebra_t)
allow zebra_t { etc_t etc_runtime_t }:file { getattr read };

allow zebra_t self:process setcap;
allow zebra_t self:capability { setgid setuid net_bind_service net_admin net_raw };
file_type_auto_trans(zebra_t, var_run_t, zebra_var_run_t, sock_file)

logdir_domain(zebra)

# /tmp/.bgpd is such a bad idea!
tmp_domain(zebra, `', sock_file)

allow zebra_t self:unix_dgram_socket create_socket_perms;
allow zebra_t self:unix_stream_socket { connectto create_stream_socket_perms };
allow zebra_t self:rawip_socket create_socket_perms;
allow zebra_t self:netlink_route_socket rw_netlink_socket_perms;
allow zebra_t zebra_port_t:tcp_socket name_bind;

allow zebra_t proc_t:file { getattr read };
allow zebra_t { sysctl_t sysctl_net_t }:dir search;
allow zebra_t sysctl_net_t:file rw_file_perms;