policy_module(pingd, 1.1.0)

########################################
#
# Declarations
#

type pingd_t;
type pingd_exec_t;
init_daemon_domain(pingd_t, pingd_exec_t)

type pingd_etc_t;
files_config_file(pingd_etc_t)

type pingd_initrc_exec_t;
init_script_file(pingd_initrc_exec_t)

type pingd_modules_t;
files_type(pingd_modules_t)

########################################
#
# Local policy
#

allow pingd_t self:capability net_raw;
allow pingd_t self:tcp_socket { accept listen };
allow pingd_t self:rawip_socket create_socket_perms;

allow pingd_t pingd_etc_t:file read_file_perms;

read_files_pattern(pingd_t, pingd_modules_t, pingd_modules_t)
mmap_files_pattern(pingd_t, pingd_modules_t, pingd_modules_t)

corenet_all_recvfrom_unlabeled(pingd_t)
corenet_all_recvfrom_netlabel(pingd_t)
corenet_tcp_sendrecv_generic_if(pingd_t)
corenet_raw_sendrecv_generic_if(pingd_t)
corenet_tcp_sendrecv_generic_node(pingd_t)
corenet_raw_sendrecv_generic_node(pingd_t)
corenet_tcp_sendrecv_all_ports(pingd_t)
corenet_raw_bind_generic_node(pingd_t)
corenet_tcp_bind_generic_node(pingd_t)

corenet_sendrecv_pingd_server_packets(pingd_t)
corenet_tcp_bind_pingd_port(pingd_t)

dev_read_urand(pingd_t)

auth_use_nsswitch(pingd_t)

files_search_usr(pingd_t)

logging_send_syslog_msg(pingd_t)