## <summary>policy for dirsrv</summary>

########################################
## <summary>
##	Execute a domain transition to run dirsrv.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
#
interface(`dirsrv_domtrans',`
	gen_require(`
		type dirsrv_t, dirsrv_exec_t;
	')

	domtrans_pattern($1, dirsrv_exec_t,dirsrv_t)
')

########################################
## <summary>
##	Execute dirsrv in the dirsrv domain, and
##	allow the specified role the dirsrv domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
#
interface(`dirsrv_run',`
	gen_require(`
		type dirsrv_t;
	')

	dirsrv_domtrans($1)
	role $2 types dirsrv_t;
')

########################################
## <summary>
##  Allow caller to signal dirsrv.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`dirsrv_signal',`
	gen_require(`
		type dirsrv_t;
	')

	allow $1 dirsrv_t:process signal;
')


########################################
## <summary>
##      Send a null signal to dirsrv.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`dirsrv_signull',`
	gen_require(`
		type dirsrv_t;
	')

	allow $1 dirsrv_t:process signull;
')

########################################
## <summary>
##	Execute dirsrv server in the dirsrv domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
#
interface(`dirsrv_systemctl',`
	gen_require(`
		type dirsrv_unit_file_t;
		type dirsrv_t;
	')

	systemd_exec_systemctl($1)
	init_reload_services($1)
	allow $1 dirsrv_unit_file_t:file read_file_perms;
	allow $1 dirsrv_unit_file_t:service manage_service_perms;

	ps_process_pattern($1, dirsrv_t)
')



#######################################
## <summary>
##      Allow a domain to manage dirsrv logs.
## </summary>
## <param name="domain">
## <summary>
##      Domain allowed access.
## </summary>
## </param>
#
interface(`dirsrv_manage_log',`
	gen_require(`
		type dirsrv_var_log_t;
	')

	allow $1 dirsrv_var_log_t:dir manage_dir_perms;
	allow $1 dirsrv_var_log_t:file manage_file_perms;
	allow $1 dirsrv_var_log_t:fifo_file manage_fifo_file_perms;
')

#######################################
## <summary>
##      Allow a domain to manage dirsrv /var/lib files.
## </summary>
## <param name="domain">
## 	<summary>
##		Domain allowed access.
## 	</summary>
## </param>
#
interface(`dirsrv_manage_var_lib',`
        gen_require(`
                type dirsrv_var_lib_t;
        ')
        allow $1 dirsrv_var_lib_t:dir manage_dir_perms;
        allow $1 dirsrv_var_lib_t:file manage_file_perms;
')

########################################
## <summary>
##	Connect to dirsrv over a unix stream socket.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`dirsrv_stream_connect',`
	gen_require(`
		type dirsrv_t, dirsrv_var_run_t;
	')

	files_search_pids($1)
	stream_connect_pattern($1, dirsrv_var_run_t, dirsrv_var_run_t, dirsrv_t)
')

#######################################
## <summary>
##      Allow a domain to manage dirsrv /var/run files.
## </summary>
## <param name="domain">
## <summary>
##      Domain allowed access.
## </summary>
## </param>
#
interface(`dirsrv_manage_var_run',`
	gen_require(`
		type dirsrv_var_run_t;
	')
	allow $1 dirsrv_var_run_t:dir manage_dir_perms;
	allow $1 dirsrv_var_run_t:file manage_file_perms;
	allow $1 dirsrv_var_run_t:sock_file manage_file_perms;
')

######################################
## <summary>
##      Allow a domain to create dirsrv pid directories.
## </summary>
## <param name="domain">
## <summary>
##      Domain allowed access.
## </summary>
## </param>
#
interface(`dirsrv_pid_filetrans',`
        gen_require(`
                type dirsrv_var_run_t;
        ')
        # Allow creating a dir in /var/run with this type
        files_pid_filetrans($1, dirsrv_var_run_t, dir)
')

#######################################
## <summary>
##      Allow a domain to read dirsrv /var/run files.
## </summary>
## <param name="domain">
## <summary>
##      Domain allowed access.
## </summary>
## </param>
#
interface(`dirsrv_read_var_run',`
        gen_require(`
                type dirsrv_var_run_t;
        ')
        allow $1 dirsrv_var_run_t:dir list_dir_perms;
        allow $1 dirsrv_var_run_t:file read_file_perms;
')

########################################
## <summary>
##      Manage dirsrv configuration files.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`dirsrv_manage_config',`
	gen_require(`
		type dirsrv_config_t;
	')

	allow $1 dirsrv_config_t:dir manage_dir_perms;
	allow $1 dirsrv_config_t:file manage_file_perms;
')

########################################
## <summary>
##      Read dirsrv share files.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`dirsrv_read_share',`
	gen_require(`
		type dirsrv_share_t;
	')

	allow $1 dirsrv_share_t:dir list_dir_perms;
	allow $1 dirsrv_share_t:file { map read_file_perms };
	allow $1 dirsrv_share_t:lnk_file read;
')

########################################
## <summary>
##	Allow dirsrv noatsecure
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`dirsrv_noatsecure',`
	gen_require(`
		type dirsrv_t;
	')

    allow $1 dirsrv_t:process { noatsecure };
')

########################################
## <summary>
##	Do not audit attempts to list dirsrv tmpfs directories
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit
##	</summary>
## </param>
#
interface(`dirsrv_dontaudit_list_tmpfs_dirs',`
	gen_require(`
		type dirsrv_tmpfs_t;
	')

	dontaudit $1 dirsrv_tmpfs_t:dir list_dir_perms;
')