policy_module(centreon-gorgoned, @VERSION@)

########################################
#
# Declarations
#
require {
	type unconfined_t;
	type unconfined_service_t;
	type useradd_t;
	type fs_t;
	type kernel_t;
	type setroubleshootd_t;
	type rpm_script_t;
	type setfiles_t;
	type unconfined_domain_type;
}

type centreon_gorgoned_t;
type centreon_gorgoned_exec_t;
init_daemon_domain(centreon_gorgoned_t, centreon_gorgoned_exec_t)

########################################
#
# Centreon local policy
#

allow centreon_gorgoned_t self:process { setpgid signal_perms };
allow centreon_gorgoned_t self:tcp_socket { accept listen };
allow centreon_gorgoned_t self:file { read open write getattr read_file_perms relabelto };
allow centreon_gorgoned_t fs_t:filesystem associate;
allow rpm_script_t centreon_gorgoned_t:dir { getattr search };

#============= setroubleshootd_t ==============
allow setroubleshootd_t centreon_gorgoned_t:dir { getattr search };
allow setroubleshootd_t centreon_gorgoned_t:file getattr;

#============= unconfined_t ==============
allow unconfined_t centreon_gorgoned_t:dir { getattr setattr relabelfrom relabelto };
allow unconfined_t centreon_gorgoned_t:file { getattr setattr relabelto rename };

#============= unconfined_service_t ==============
allow unconfined_service_t centreon_gorgoned_t:file { create read open write rename getattr setattr ioctl lock unlink };
allow unconfined_service_t centreon_gorgoned_t:dir { getattr setattr search create write add_name remove_name };

#============= useradd_t ==============
allow useradd_t centreon_gorgoned_t:dir { getattr search setattr create write add_name remove_name };
allow useradd_t centreon_gorgoned_t:file { open write read unlink create setattr getattr ioctl lock };

#============= setfiles_t ==============
allow setfiles_t centreon_gorgoned_t:dir relabelto;
allow setfiles_t centreon_gorgoned_t:file relabelto;

#============= kernel_t ==============
allow kernel_t centreon_gorgoned_t:dir { getattr search setattr create write add_name remove_name };
allow kernel_t centreon_gorgoned_t:file { open write read unlink create setattr getattr ioctl lock };

#============= cluster ===============
allow daemon initrc_transition_domain:fifo_file { ioctl read write getattr lock append };                                        
allow domain unconfined_domain_type:association recvfrom; 
allow domain domain:key { search link }; 
allow domain unconfined_domain_type:tcp_socket recvfrom; 
allow centreon_gorgoned_t domain:lnk_file { read getattr }; 
allow daemon initrc_domain:fd use; 
allow centreon_gorgoned_t domain:file { ioctl read getattr lock open }; 
allow daemon initrc_domain:process sigchld; 
allow domain unconfined_domain_type:peer recv; 
allow centreon_gorgoned_t domain:dir { ioctl read getattr lock search open }; 
allow daemon initrc_transition_domain:fd use; 
allow daemon initrc_domain:fifo_file { ioctl read write getattr lock append }; 

mysql_stream_connect(centreon_gorgoned_t)
mysql_tcp_connect(centreon_gorgoned_t)

kernel_read_kernel_sysctls(centreon_gorgoned_t)
kernel_read_net_sysctls(centreon_gorgoned_t)
kernel_read_network_state(centreon_gorgoned_t)
kernel_read_system_state(centreon_gorgoned_t)
kernel_request_load_module(centreon_gorgoned_t)

corecmd_exec_bin(centreon_gorgoned_t)
corecmd_exec_shell(centreon_gorgoned_t)

corenet_port(centreon_gorgoned_t)
corenet_all_recvfrom_unlabeled(centreon_gorgoned_t)
corenet_all_recvfrom_netlabel(centreon_gorgoned_t)
corenet_tcp_sendrecv_generic_if(centreon_gorgoned_t)
corenet_udp_sendrecv_generic_if(centreon_gorgoned_t)
corenet_tcp_sendrecv_generic_node(centreon_gorgoned_t)
corenet_udp_sendrecv_generic_node(centreon_gorgoned_t)
corenet_tcp_bind_generic_node(centreon_gorgoned_t)
corenet_udp_bind_generic_node(centreon_gorgoned_t)
corenet_sendrecv_all_client_packets(centreon_gorgoned_t)
corenet_tcp_connect_all_ports(centreon_gorgoned_t)
corenet_tcp_sendrecv_all_ports(centreon_gorgoned_t)

corenet_sendrecv_inetd_child_server_packets(centreon_gorgoned_t)
corenet_tcp_bind_inetd_child_port(centreon_gorgoned_t)
corenet_tcp_sendrecv_inetd_child_port(centreon_gorgoned_t)

dev_read_sysfs(centreon_gorgoned_t)
dev_read_urand(centreon_gorgoned_t)

domain_use_interactive_fds(centreon_gorgoned_t)
domain_read_all_domains_state(centreon_gorgoned_t)

files_read_etc_runtime_files(centreon_gorgoned_t)
files_read_usr_files(centreon_gorgoned_t)

fs_getattr_all_fs(centreon_gorgoned_t)
fs_search_auto_mountpoints(centreon_gorgoned_t)

auth_use_nsswitch(centreon_gorgoned_t)

logging_send_syslog_msg(centreon_gorgoned_t)

miscfiles_read_localization(centreon_gorgoned_t)

userdom_dontaudit_use_unpriv_user_fds(centreon_gorgoned_t)