[selinux-policy: 837/3172] fixes

[Daniel J Walsh]

commit 60789e16d0b7cf738186e131b59d6ab43eaac6c6
Author: Chris PeBenito <cpebenito at tresys.com>
Date:   Tue Oct 25 02:51:07 2005 +0000

    fixes

 refpolicy/policy/modules/kernel/devices.if |   16 ++++++++++++++++
 refpolicy/policy/modules/services/mta.if   |    2 +-
 refpolicy/policy/modules/services/mta.te   |    2 +-
 refpolicy/policy/modules/services/nis.te   |    2 ++
 refpolicy/policy/modules/services/zebra.te |   22 +++++++++++++++++++++-
 5 files changed, 41 insertions(+), 3 deletions(-)
---
diff --git a/refpolicy/policy/modules/kernel/devices.if b/refpolicy/policy/modules/kernel/devices.if
index d442432..c6f5225 100644
--- a/refpolicy/policy/modules/kernel/devices.if
+++ b/refpolicy/policy/modules/kernel/devices.if
@@ -1919,6 +1919,22 @@ interface(`dev_mount_usbfs',`
 
 ########################################
 ## <summary>
+##	Mount a usbfs filesystem.
+## </summary>
+## <param name="domain">
+##	The type of the process performing this action.
+## </param>
+#
+interface(`dev_associate_usbfs',`
+	gen_require(`
+		type usbfs_t;
+	')
+
+	allow $1 usbfs_t:filesystem associate;
+')
+
+########################################
+## <summary>
 ##	Get the attributes of a directory in the usb filesystem.
 ## </summary>
 ## <param name="domain">
diff --git a/refpolicy/policy/modules/services/mta.if b/refpolicy/policy/modules/services/mta.if
index 20ecf47..f797e16 100644
--- a/refpolicy/policy/modules/services/mta.if
+++ b/refpolicy/policy/modules/services/mta.if
@@ -562,7 +562,7 @@ interface(`mta_manage_queue',`
 # cjp: added for postfix
 interface(`mta_read_sendmail_bin',`
 	gen_require(`
-		type sendmail_exec_t;;
+		type sendmail_exec_t;
 	')
 
 	allow $1 sendmail_exec_t:file r_file_perms;
diff --git a/refpolicy/policy/modules/services/mta.te b/refpolicy/policy/modules/services/mta.te
index 634838c..d037b76 100644
--- a/refpolicy/policy/modules/services/mta.te
+++ b/refpolicy/policy/modules/services/mta.te
@@ -172,7 +172,7 @@ optional_policy(`postfix.te',`
 	allow system_mail_t etc_aliases_t:lnk_file create_lnk_perms;
 	allow system_mail_t etc_aliases_t:sock_file create_file_perms;
 	allow system_mail_t etc_aliases_t:fifo_file create_file_perms;
-	files_create_etc_config(sysadm_mail_t,etc_aliases_t,{ file lnk_file sock_file fifo_file })
+	files_create_etc_config(system_mail_t,etc_aliases_t,{ file lnk_file sock_file fifo_file })
 
 	optional_policy(`crond.te',`
 		cron_crw_tcp_socket(system_mail_t)
diff --git a/refpolicy/policy/modules/services/nis.te b/refpolicy/policy/modules/services/nis.te
index 7b8811c..f3da45f 100644
--- a/refpolicy/policy/modules/services/nis.te
+++ b/refpolicy/policy/modules/services/nis.te
@@ -44,6 +44,7 @@ allow ypbind_t self:netlink_route_socket r_netlink_socket_perms;
 allow ypbind_t self:tcp_socket { listen accept };
 allow ypbind_t self:tcp_socket { create connect ioctl read getattr write setattr append bind getopt setopt shutdown };
 allow ypbind_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown };
+allow ypserv_t self:udp_socket { ioctl read write create getattr setattr append bind getopt setopt shutdown connect };
 
 allow ypbind_t ypbind_tmp_t:dir create_dir_perms;
 allow ypbind_t ypbind_tmp_t:file create_file_perms;
@@ -154,6 +155,7 @@ allow ypserv_t ypserv_tmp_t:dir create_dir_perms;
 allow ypserv_t ypserv_tmp_t:file create_file_perms;
 files_create_tmp_files(ypserv_t, ypserv_tmp_t, { file dir })
 
+allow ypserv_t ypserv_var_run_t:dir { ioctl read write getattr lock add_name remove_name search };
 allow ypserv_t ypserv_var_run_t:file { getattr create read write append setattr unlink };
 files_create_pid(ypserv_t,ypserv_var_run_t)
 
diff --git a/refpolicy/policy/modules/services/zebra.te b/refpolicy/policy/modules/services/zebra.te
index 2fd74d0..de58ab6 100644
--- a/refpolicy/policy/modules/services/zebra.te
+++ b/refpolicy/policy/modules/services/zebra.te
@@ -30,11 +30,13 @@ files_pid_file(zebra_var_run_t)
 allow zebra_t self:capability { setgid setuid net_admin net_raw };
 dontaudit zebra_t self:capability sys_tty_config;
 allow zebra_t self:process setcap;
+allow zebra_t self:file { ioctl read write getattr lock append };
 allow zebra_t self:unix_dgram_socket create_socket_perms;
 allow zebra_t self:unix_stream_socket { connectto create_stream_socket_perms };
 allow zebra_t self:netlink_route_socket r_netlink_socket_perms;
 allow zebra_t self:tcp_socket create_stream_socket_perms;
 allow zebra_t self:rawip_socket create_socket_perms;
+allow zebra_t self:capability net_bind_service;
 
 allow zebra_t zebra_conf_t:dir r_dir_perms;
 allow zebra_t zebra_conf_t:file r_file_perms;
@@ -50,10 +52,11 @@ allow zebra_t zebra_tmp_t:sock_file create_file_perms;
 files_create_tmp_files(zebra_t,zebra_tmp_t,sock_file)
 
 allow zebra_t zebra_var_run_t:file create_file_perms;
-files_create_pid(zebra_t,zebra_var_run_t)
+files_create_pid(zebra_t,zebra_var_run_t, { file sock_file })
 
 kernel_read_system_state(zebra_t)
 kernel_read_kernel_sysctl(zebra_t)
+kernel_tcp_recvfrom(zebra_t)
 kernel_rw_net_sysctl(zebra_t)
 
 corenet_tcp_sendrecv_all_if(zebra_t)
@@ -67,16 +70,24 @@ corenet_udp_sendrecv_all_ports(zebra_t)
 corenet_tcp_bind_all_nodes(zebra_t)
 corenet_udp_bind_all_nodes(zebra_t)
 corenet_tcp_bind_zebra_port(zebra_t)
+corenet_tcp_bind_all_reserved_ports(zebra_t)
+corenet_tcp_connect_all_reserved_ports(zebra_t)
 
+dev_associate_usbfs(zebra_var_run_t)
+dev_list_all_dev_nodes(zebra_t)
 dev_read_sysfs(zebra_t)
+dev_read_sysfs(zebra_tmp_t)
+dev_rw_zero_dev(zebra_t)
 
 fs_getattr_all_fs(zebra_t)
 fs_search_auto_mountpoints(zebra_t)
 
 term_dontaudit_use_console(zebra_t)
+term_list_ptys(zebra_t)
 
 domain_use_wide_inherit_fd(zebra_t)
 
+files_search_etc(zebra_t)
 files_read_etc_files(zebra_t)
 files_read_etc_runtime_files(zebra_t)
 
@@ -99,12 +110,21 @@ ifdef(`targeted_policy', `
 	term_dontaudit_use_unallocated_tty(zebra_t)
 	term_dontaudit_use_generic_pty(zebra_t)
 	files_dontaudit_read_root_file(zebra_t)
+	unconfined_sigchld(zebra_t)
+')
+
+optional_policy(`ldap.te',`
+	ldap_use(zebra_t)
 ')
 
 optional_policy(`nis.te',`
 	nis_use_ypbind(zebra_t)
 ')
 
+optional_policy(`zebra.te',`
+	rpm_read_pipe(zebra_t)
+')
+
 optional_policy(`selinuxutil.te',`
 	seutil_sigchld_newrole(zebra_t)
 ')