policy_module(insights_client, 1.0.0)

gen_require(`
	class passwd rootok;
')

########################################
#
# Declarations
#

type insights_client_t;
type insights_client_exec_t;
init_daemon_domain(insights_client_t, insights_client_exec_t)

type insights_client_var_log_t;
logging_log_file(insights_client_var_log_t)

type insights_client_etc_t;
files_config_file(insights_client_etc_t)

type insights_client_etc_rw_t;
files_config_file(insights_client_etc_rw_t)

type insights_client_cache_t;
files_type(insights_client_cache_t)

type insights_client_var_lib_t;
files_type(insights_client_var_lib_t)

type insights_client_var_lock_t;
files_lock_file(insights_client_var_lock_t)

type insights_client_var_run_t;
files_pid_file(insights_client_var_run_t)

type insights_client_tmp_t;
files_tmp_file(insights_client_tmp_t)

type insights_client_tmpfs_t;
files_tmpfs_file(insights_client_tmpfs_t)

type insights_client_unit_file_t;
systemd_unit_file(insights_client_unit_file_t)

########################################
#
# insights_client local policy
#
allow insights_client_t self:capability { dac_override dac_read_search fowner ipc_owner kill net_admin setgid setuid sys_admin sys_nice sys_ptrace sys_rawio sys_resource };
allow insights_client_t self:cap_userns sys_ptrace;
allow insights_client_t self:fifo_file rw_fifo_file_perms;
allow insights_client_t self:netlink_generic_socket create_socket_perms;
allow insights_client_t self:netlink_netfilter_socket create_socket_perms;
allow insights_client_t self:netlink_route_socket create_netlink_socket_perms;
allow insights_client_t self:netlink_selinux_socket create_socket_perms;
allow insights_client_t self:netlink_tcpdiag_socket create_netlink_socket_perms;
allow insights_client_t self:passwd rootok;
allow insights_client_t self:process { getattr setfscreate setpgid setrlimit setsched };
allow insights_client_t self:tcp_socket create_socket_perms;
allow insights_client_t self:udp_socket create_socket_perms;
allow insights_client_t self:unix_dgram_socket create_socket_perms;
allow insights_client_t self:unix_stream_socket create_stream_socket_perms;
allow insights_client_t self:vsock_socket create_socket_perms;

manage_dirs_pattern(insights_client_t, insights_client_etc_t, insights_client_etc_t)
read_files_pattern(insights_client_t, insights_client_etc_t, insights_client_etc_t)
manage_files_pattern(insights_client_t, insights_client_etc_rw_t, insights_client_etc_rw_t)
insights_client_filetrans_named_content(insights_client_t)

manage_files_pattern(insights_client_t, insights_client_cache_t, insights_client_cache_t)

manage_dirs_pattern(insights_client_t, insights_client_var_lib_t, insights_client_var_lib_t)
manage_files_pattern(insights_client_t, insights_client_var_lib_t, insights_client_var_lib_t)
files_var_lib_filetrans(insights_client_t, insights_client_var_lib_t, { dir file })

manage_dirs_pattern(insights_client_t, insights_client_var_lock_t, insights_client_var_lock_t)
manage_files_pattern(insights_client_t, insights_client_var_lock_t, insights_client_var_lock_t)
files_lock_filetrans(insights_client_t, insights_client_var_lock_t, dir)

manage_dirs_pattern(insights_client_t, insights_client_var_log_t, insights_client_var_log_t)
manage_files_pattern(insights_client_t, insights_client_var_log_t, insights_client_var_log_t)
logging_log_filetrans(insights_client_t, insights_client_var_log_t, dir)

manage_dirs_pattern(insights_client_t, insights_client_var_run_t, insights_client_var_run_t)
manage_files_pattern(insights_client_t, insights_client_var_run_t, insights_client_var_run_t)
files_pid_filetrans(insights_client_t, insights_client_var_run_t, { dir file })

manage_dirs_pattern(insights_client_t, insights_client_tmp_t, insights_client_tmp_t)
manage_files_pattern(insights_client_t, insights_client_tmp_t, insights_client_tmp_t)
files_tmp_filetrans(insights_client_t, insights_client_tmp_t, { dir file })
allow insights_client_t insights_client_tmp_t:dir relabel_dir_perms;
allow insights_client_t insights_client_tmp_t:file relabel_dir_perms;

manage_files_pattern(insights_client_t, insights_client_tmpfs_t, insights_client_tmpfs_t)
fs_tmpfs_filetrans(insights_client_t, insights_client_tmpfs_t, file)
can_exec(insights_client_t, insights_client_tmpfs_t)

allow insights_client_t insights_client_unit_file_t:file read_file_perms;
allow insights_client_t insights_client_unit_file_t:service manage_service_perms;

kernel_dgram_send(insights_client_t)
kernel_get_sysvipc_info(insights_client_t)
kernel_list_all_proc(insights_client_t)
kernel_read_device_sysctls(insights_client_t)
kernel_read_fs_sysctls(insights_client_t)
kernel_read_kernel_ns_lastpid_sysctls(insights_client_t)
kernel_read_net_sysctls(insights_client_t)
kernel_read_network_state(insights_client_t)
kernel_read_proc_files(insights_client_t)
kernel_read_rpc_sysctls(insights_client_t)
kernel_read_ring_buffer(insights_client_t)
kernel_read_security_state(insights_client_t)
kernel_read_software_raid_state(insights_client_t)
kernel_read_system_state(insights_client_t)
kernel_read_unix_sysctls(insights_client_t)
kernel_read_usermodehelper_state(insights_client_t)
kernel_read_vm_sysctls(insights_client_t)
kernel_request_load_module(insights_client_t)
kernel_view_key(insights_client_t)

corecmd_exec_all_executables(insights_client_t)
corenet_tcp_bind_generic_node(insights_client_t)
corenet_tcp_connect_all_ports(insights_client_t)
corenet_udp_bind_generic_node(insights_client_t)

dev_getattr_all(insights_client_t)
dev_getattr_all_blk_files(insights_client_t)
dev_getattr_all_chr_files(insights_client_t)
dev_read_cpuid(insights_client_t)
dev_read_kmsg(insights_client_t)
dev_read_netcontrol(insights_client_t)
dev_read_raw_memory(insights_client_t)
dev_read_vsock(insights_client_t)
dev_dontaudit_write_raw_memory(insights_client_t)
dev_read_sysfs(insights_client_t)
dev_rw_lvm_control(insights_client_t)

domain_connect_all_stream_sockets(insights_client_t)
domain_getattr_all_domains(insights_client_t)
domain_getattr_all_sockets(insights_client_t)
domain_getattr_all_pipes(insights_client_t)
domain_manage_all_domains_keyrings(insights_client_t)
domain_read_all_domains_state(insights_client_t)
domain_signal_all_domains(insights_client_t)
domain_signull_all_domains(insights_client_t)
domain_unix_read_all_semaphores(insights_client_t)
domain_use_interactive_fds(insights_client_t)

files_getattr_all_files(insights_client_t)
files_getattr_all_blk_files(insights_client_t)
files_getattr_all_chr_files(insights_client_t)
files_getattr_all_file_type_fs(insights_client_t)
files_getattr_all_pipes(insights_client_t)
files_getattr_all_sockets(insights_client_t)
files_manage_etc_symlinks(insights_client_t)
files_manage_generic_locks(insights_client_t)
files_map_read_etc_files(insights_client_t)
files_read_non_security_files(insights_client_t)
files_read_all_symlinks(insights_client_t)
files_status_etc(insights_client_t)
files_write_generic_tmp_sock_files(insights_client_t)

fs_getattr_all_fs(insights_client_t)
fs_getattr_all_files(insights_client_t)
fs_read_configfs_dirs(insights_client_t)

init_dontaudit_read_state(insights_client_t)
init_reload_services(insights_client_t)
init_status(insights_client_t)
init_status_all_script_files(insights_client_t)
init_view_key(insights_client_t)

libs_exec_ldconfig(insights_client_t)

miscfiles_read_generic_certs(insights_client_t)
miscfiles_read_localization(insights_client_t)

selinux_compute_access_vector(insights_client_t)

seutil_domtrans_semanage(insights_client_t)
seutil_read_config(insights_client_t)
seutil_read_module_store(insights_client_t)

storage_raw_read_fixed_disk(insights_client_t)

optional_policy(`
	abrt_dbus_chat(insights_client_t)
')

optional_policy(`
	apache_exec_modules(insights_client_t)
	apache_read_semaphores(insights_client_t)
')

optional_policy(`
	auth_domtrans_chk_passwd(insights_client_t)
	auth_read_passwd(insights_client_t)
	auth_rw_lastlog(insights_client_t)
')

optional_policy(`
	bind_domtrans_ndc(insights_client_t)
')

optional_policy(`
	bootloader_exec(insights_client_t)
')

optional_policy(`
	certmonger_dbus_chat(insights_client_t)
')

optional_policy(`
	chronyd_dgram_send(insights_client_t)
	chronyd_domtrans_chronyc(insights_client_t)
	chronyd_manage_pid(insights_client_t)
	chronyd_stream_connect(insights_client_t)
')

optional_policy(`
	container_runtime_domtrans(insights_client_t)
')

optional_policy(`
	cron_signull_system_job(insights_client_t)
	cron_system_entry(insights_client_t, insights_client_exec_t)
')

optional_policy(`
	dbus_system_bus_client(insights_client_t)
')

optional_policy(`
	dmesg_exec(insights_client_t)
')

optional_policy(`
	dmidecode_exec(insights_client_t)
')

optional_policy(`
	fstools_domtrans(insights_client_t)
	fsadm_manage_pid(insights_client_t)
')

optional_policy(`
	firewalld_dbus_chat(insights_client_t)
')

optional_policy(`
	fwupd_dbus_chat(insights_client_t)
')

optional_policy(`
	gen_require(`
		type glusterd_log_t;
	')

	logging_log_filetrans(insights_client_t, glusterd_log_t, dir, "gluster")
')

optional_policy(`
	gnome_search_gconf(insights_client_t)
	gnome_manage_generic_cache_files(insights_client_t)
	gnome_manage_home_config(insights_client_t)
	gnome_manage_home_config_dirs(insights_client_t)
')

optional_policy(`
	gpg_domtrans(insights_client_t)
	gpg_manage_admin_home_content(insights_client_t)
')

optional_policy(`
	hostname_exec(insights_client_t)
')

optional_policy(`
	init_stream_connect(insights_client_t)
')

optional_policy(`
	iptables_domtrans(insights_client_t)
')

optional_policy(`
	journalctl_domtrans(insights_client_t)
')

optional_policy(`
	logging_domtrans_auditctl(insights_client_t)
	logging_mmap_journal(insights_client_t)
	logging_read_audit_config(insights_client_t)
	logging_read_audit_log(insights_client_t)
	logging_send_syslog_msg(insights_client_t)
')

optional_policy(`
	lpd_domtrans_lpr(insights_client_t)
')

optional_policy(`
	lvm_domtrans(insights_client_t)
	lvm_manage_metadata(insights_client_t)
')

optional_policy(`
	mount_domtrans(insights_client_t)
')

optional_policy(`
	mysql_stream_connect(insights_client_t)
')

optional_policy(`
	modutils_domtrans_kmod(insights_client_t)
	modutils_read_module_deps_files(insights_client_t)
')

optional_policy(`
	networkmanager_dbus_chat(insights_client_t)
')

optional_policy(`
	openvswitch_stream_connect(insights_client_t)
')

optional_policy(`
	pcp_filetrans_named_content(insights_client_t)
	pcp_write_pid_sock_file(insights_client_t)
')

optional_policy(`
	postgresql_stream_connect(insights_client_t)
')

optional_policy(`
	redis_stream_connect(insights_client_t)
')

optional_policy(`
	rhnsd_read_config(insights_client_t)
')

optional_policy(`
	rhsmcertd_manage_config_files(insights_client_t)
	rhsmcertd_manage_pid_files(insights_client_t)
	rhsmcertd_manage_lib_files(insights_client_t)
	rhsmcertd_manage_log(insights_client_t)
')

optional_policy(`
	rpm_domtrans(insights_client_t)
	rpm_manage_db(insights_client_t)
	rpm_manage_cache(insights_client_t)
	rpm_hawkey_named_filetrans(insights_client_t)
	rpm_read_db(insights_client_t)
	rpm_signull(insights_client_t)
')

optional_policy(`
	rtas_errd_dontaudit_write_lock(insights_client_t)
')

optional_policy(`
	samba_manage_var_dirs(insights_client_t)
	samba_manage_var_files(insights_client_t)
	samba_manage_var_sock_files(insights_client_t)
')

optional_policy(`
	setroubleshoot_dbus_chat(insights_client_t)
	setroubleshoot_stream_connect(insights_client_t)
')

optional_policy(`
	sysnet_exec_ifconfig(insights_client_t)
	sysnet_read_config(insights_client_t)
')

optional_policy(`
	systemd_dbus_chat_logind(insights_client_t)
	systemd_dbus_chat_timedated(insights_client_t)
	systemd_start_all_unit_files(insights_client_t)
	systemd_status_all_unit_files(insights_client_t)
	systemd_machined_stream_connect(insights_client_t)
	systemd_userdbd_stream_connect(insights_client_t)
')

optional_policy(`
	timedatex_dbus_chat(insights_client_t)
')

optional_policy(`
	tuned_dbus_chat(insights_client_t)
')

optional_policy(`
	unconfined_server_create_shm(insights_client_t)
')

optional_policy(`
	userdom_manage_admin_files(insights_client_t)
	userdom_user_tmp_filetrans(insights_client_t, insights_client_tmp_t, { dir file })
	userdom_view_all_users_keys(insights_client_t)
')

optional_policy(`
	virt_stream_connect(insights_client_t)
')