selinux-policy/strict/domains/program/zebra.te
2005-09-12 21:40:56 +00:00

33 lines
1.0 KiB
Plaintext

#DESC Zebra - BGP server
#
# Author: Russell Coker <russell@coker.com.au>
# X-Debian-Packages: zebra
#
daemon_domain(zebra, `, sysctl_net_writer')
type zebra_conf_t, file_type, sysadmfile;
r_dir_file({ initrc_t zebra_t }, zebra_conf_t)
can_network_server(zebra_t)
can_ypbind(zebra_t)
allow zebra_t { etc_t etc_runtime_t }:file { getattr read };
allow zebra_t self:process setcap;
allow zebra_t self:capability { setgid setuid net_bind_service net_admin net_raw };
file_type_auto_trans(zebra_t, var_run_t, zebra_var_run_t, sock_file)
logdir_domain(zebra)
# /tmp/.bgpd is such a bad idea!
tmp_domain(zebra, `', sock_file)
allow zebra_t self:unix_dgram_socket create_socket_perms;
allow zebra_t self:unix_stream_socket { connectto create_stream_socket_perms };
allow zebra_t self:rawip_socket create_socket_perms;
allow zebra_t self:netlink_route_socket r_netlink_socket_perms;
allow zebra_t zebra_port_t:tcp_socket name_bind;
allow zebra_t proc_t:file { getattr read };
allow zebra_t { sysctl_t sysctl_net_t }:dir search;
allow zebra_t sysctl_net_t:file rw_file_perms;