[selinux-policy: 980/3172] fix superfluous network rules pointed out by dan walsh, and clean

[Daniel J Walsh]

commit 1354ca04a611fe3d419b274e8844d48ae89a6c2c
Author: Chris PeBenito <cpebenito at tresys.com>
Date:   Fri Nov 18 15:53:34 2005 +0000

    fix superfluous network rules pointed out by dan walsh, and clean

 refpolicy/policy/modules/services/zebra.te |    9 +++------
 1 files changed, 3 insertions(+), 6 deletions(-)
---
diff --git a/refpolicy/policy/modules/services/zebra.te b/refpolicy/policy/modules/services/zebra.te
index 6d6c5f2..615f6a2 100644
--- a/refpolicy/policy/modules/services/zebra.te
+++ b/refpolicy/policy/modules/services/zebra.te
@@ -29,12 +29,12 @@ files_pid_file(zebra_var_run_t)
 
 allow zebra_t self:capability { setgid setuid net_admin net_raw net_bind_service };
 dontaudit zebra_t self:capability sys_tty_config;
-allow zebra_t self:process setcap;
+allow zebra_t self:process { signal_perms setcap };
 allow zebra_t self:file { ioctl read write getattr lock append };
 allow zebra_t self:unix_dgram_socket create_socket_perms;
 allow zebra_t self:unix_stream_socket { connectto create_stream_socket_perms };
 allow zebra_t self:netlink_route_socket r_netlink_socket_perms;
-allow zebra_t self:tcp_socket create_stream_socket_perms;
+allow zebra_t self:tcp_socket connected_stream_socket_perms;
 allow zebra_t self:udp_socket create_socket_perms;
 allow zebra_t self:rawip_socket create_socket_perms;
 
@@ -44,7 +44,7 @@ allow zebra_t zebra_conf_t:lnk_file { getattr read };
 
 allow zebra_t zebra_log_t:file create_file_perms;
 allow zebra_t zebra_log_t:sock_file create_file_perms;
-allow zebra_t zebra_log_t:dir rw_dir_perms;
+allow zebra_t zebra_log_t:dir { rw_dir_perms setattr };
 logging_create_log(zebra_t,zebra_log_t,{ sock_file file dir })
 
 # /tmp/.bgpd is such a bad idea!
@@ -72,13 +72,10 @@ corenet_udp_sendrecv_all_ports(zebra_t)
 corenet_tcp_bind_all_nodes(zebra_t)
 corenet_udp_bind_all_nodes(zebra_t)
 corenet_tcp_bind_zebra_port(zebra_t)
-corenet_tcp_bind_all_reserved_ports(zebra_t)
-corenet_tcp_connect_all_reserved_ports(zebra_t)
 
 dev_associate_usbfs(zebra_var_run_t)
 dev_list_all_dev_nodes(zebra_t)
 dev_read_sysfs(zebra_t)
-dev_read_sysfs(zebra_tmp_t)
 dev_rw_zero_dev(zebra_t)
 
 fs_getattr_all_fs(zebra_t)