fapolicyd.if

## <summary>policy for fapolicyd</summary>

########################################
## <summary>
##	Execute fapolicyd_exec_t in the fapolicyd domain.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
#
interface(`fapolicyd_domtrans',`
	gen_require(`
		type fapolicyd_t, fapolicyd_exec_t;
	')

	corecmd_search_bin($1)
	domtrans_pattern($1, fapolicyd_exec_t, fapolicyd_t)
')

######################################
## <summary>
##	Execute fapolicyd in the caller domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`fapolicyd_exec',`
	gen_require(`
		type fapolicyd_exec_t;
	')

	corecmd_search_bin($1)
	can_exec($1, fapolicyd_exec_t)
')

########################################
## <summary>
##	Search fapolicyd lib directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`fapolicyd_search_lib',`
	gen_require(`
		type fapolicyd_var_lib_t;
	')

	allow $1 fapolicyd_var_lib_t:dir search_dir_perms;
	files_search_var_lib($1)
')

########################################
## <summary>
##	Read fapolicyd lib files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`fapolicyd_read_lib_files',`
	gen_require(`
		type fapolicyd_var_lib_t;
	')

	files_search_var_lib($1)
	read_files_pattern($1, fapolicyd_var_lib_t, fapolicyd_var_lib_t)
')

########################################
## <summary>
##	Manage fapolicyd lib files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`fapolicyd_manage_lib_files',`
	gen_require(`
		type fapolicyd_var_lib_t;
	')

	files_search_var_lib($1)
	manage_files_pattern($1, fapolicyd_var_lib_t, fapolicyd_var_lib_t)
')

########################################
## <summary>
##	Manage fapolicyd lib directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`fapolicyd_manage_lib_dirs',`
	gen_require(`
		type fapolicyd_var_lib_t;
	')

	files_search_var_lib($1)
	manage_dirs_pattern($1, fapolicyd_var_lib_t, fapolicyd_var_lib_t)
')

########################################
## <summary>
##	Read fapolicyd PID files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`fapolicyd_read_pid_files',`
	gen_require(`
		type fapolicyd_var_run_t;
	')

	files_search_pids($1)
	read_files_pattern($1, fapolicyd_var_run_t, fapolicyd_var_run_t)
')

########################################
## <summary>
##	All of the rules required to administrate
##	an fapolicyd environment
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`fapolicyd_admin',`
	gen_require(`
		type fapolicyd_t;
		type fapolicyd_var_lib_t;
		type fapolicyd_var_run_t;
	')

	allow $1 fapolicyd_t:process { signal_perms };
	ps_process_pattern($1, fapolicyd_t)

        tunable_policy(`deny_ptrace',`',`
                allow $1 fapolicyd_t:process ptrace;
        ')

	files_search_var_lib($1)
	admin_pattern($1, fapolicyd_var_lib_t)
	
	logging_search_logs($1)
        admin_pattern($1, fapolicyd_log_t)
		
	files_search_pids($1)
	admin_pattern($1, fapolicyd_var_run_t)
	optional_policy(`
		systemd_passwd_agent_exec($1)
		systemd_read_fifo_file_passwd_run($1)
	')
')

########################################
# 
# Fapolicy interface compatibility blocks
#
# The following definitions ensure compatibility with distribution policy
# versions that do not contain given interfaces (epel, or older Fedora
# releases).
# Each block tests for existence of given interface and defines it if needed.
#

########################################
## <summary>
##      Watch_sb root directories.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
ifndef(`files_watch_sb_root_dirs', `
	interface(`files_watch_sb_root_dirs', `
		gen_require(`
			type root_t;
		')

		allow $1 root_t:dir watch_sb;
	')
')

########################################
## <summary>
##      Watch_sb boot directories.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
ifndef(`files_watch_sb_boot_dirs', `
	interface(`files_watch_sb_boot_dirs', `
		gen_require(`
			type boot_t;
		')

		allow $1 boot_t:dir watch_sb;
	')
')

########################################
## <summary>
##      Watch_sb tmpfs directories.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
ifndef(`fs_watch_sb_tmpfs', `
	interface(`fs_watch_sb_tmpfs', `
		gen_require(`
			type tmpfs_t;
        ')

		allow $1 tmpfs_t:dir watch_sb;
	')
')

#######################################
## <summary>
##      Watch_sb user temporary directories
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
ifndef(`userdom_watch_sb_tmp_dirs',`
	interface(`userdom_watch_sb_tmp_dirs',`
		gen_require(`
			type user_tmp_t;
		')

		allow $1 user_tmp_t:dir watch_sb;
	')
')

########################################
## <summary>
##      Watch filesystem with extended attributes
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
ifndef(`fs_watch_xattr_fs',`
	interface(`fs_watch_xattr_fs',`
		gen_require(`
			type fs_t;
		')

		allow $1 fs_t:filesystem watch;
	')
')

########################################
## <summary>
##      Watch a tmpfs filesystem.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
ifndef(`fs_watch_tmpfs',`
	interface(`fs_watch_tmpfs',`
		gen_require(`
			type tmpfs_t;
		')

		allow $1 tmpfs_t:filesystem watch;
	')
')