policy_module(chronyd, 1.2.0)

########################################
#
# Declarations
#

attribute_role chronyc_roles;
roleattribute system_r chronyc_roles;

type chronyd_t;
type chronyd_exec_t;
init_daemon_domain(chronyd_t, chronyd_exec_t)

type chronyd_restricted_t;
init_explicit_domain(chronyd_restricted_t, chronyd_exec_t)
init_nnp_daemon_domain(chronyd_restricted_t)

type chronyd_initrc_exec_t;
init_script_file(chronyd_initrc_exec_t)

type chronyd_keys_t;
files_type(chronyd_keys_t)

type chronyd_tmpfs_t;
files_tmpfs_file(chronyd_tmpfs_t)

type chronyd_unit_file_t;
systemd_unit_file(chronyd_unit_file_t)

type chronyd_var_lib_t;
files_type(chronyd_var_lib_t)

type chronyd_var_log_t;
logging_log_file(chronyd_var_log_t)

type chronyd_var_run_t;
files_pid_file(chronyd_var_run_t)

type chronyd_tmp_t;
files_tmp_file(chronyd_tmp_t)

type chronyc_t;
type chronyc_exec_t;
domain_type(chronyc_t, chronyc_exec_t)
init_system_domain(chronyc_t, chronyc_exec_t)
init_nnp_daemon_domain(chronyc_t)
role chronyc_roles types chronyc_t;

########################################
#
# Local policy
#

allow chronyd_t self:capability { dac_read_search dac_override ipc_lock fsetid setuid setgid sys_nice sys_resource sys_time chown net_admin };
allow chronyd_t self:capability2 block_suspend;
allow chronyd_t self:process { getsched setsched getcap setcap setrlimit signal };
allow chronyd_t self:shm create_shm_perms;
allow chronyd_t self:udp_socket create_socket_perms;
allow chronyd_t self:tcp_socket { accept listen };
allow chronyd_t self:unix_dgram_socket { create_socket_perms sendto };
allow chronyd_t self:fifo_file rw_fifo_file_perms;

allow chronyd_t chronyd_keys_t:file append_file_perms;
allow chronyd_t chronyd_keys_t:file setattr_file_perms;
allow chronyd_t chronyd_keys_t:file read_file_perms;

allow chronyd_t chronyc_t:unix_dgram_socket sendto;

allow chronyd_t chronyc_exec_t:file mmap_file_perms;

manage_dirs_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
manage_files_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
fs_tmpfs_filetrans(chronyd_t, chronyd_tmpfs_t, { dir file })
allow chronyd_t chronyd_tmpfs_t:file map;

manage_files_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t)
manage_dirs_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t)
manage_sock_files_pattern(chronyd_t, chronyd_var_lib_t, chronyd_var_lib_t)
files_var_lib_filetrans(chronyd_t, chronyd_var_lib_t, dir)

manage_dirs_pattern(chronyd_t, chronyd_var_log_t, chronyd_var_log_t)
append_files_pattern(chronyd_t, chronyd_var_log_t, chronyd_var_log_t)
create_files_pattern(chronyd_t, chronyd_var_log_t, chronyd_var_log_t)
setattr_files_pattern(chronyd_t, chronyd_var_log_t, chronyd_var_log_t)
logging_log_filetrans(chronyd_t, chronyd_var_log_t, dir)

manage_dirs_pattern(chronyd_t, chronyd_var_run_t, chronyd_var_run_t)
manage_files_pattern(chronyd_t, chronyd_var_run_t, chronyd_var_run_t)
manage_sock_files_pattern(chronyd_t, chronyd_var_run_t, chronyd_var_run_t)
files_pid_filetrans(chronyd_t, chronyd_var_run_t, { dir file sock_file })

manage_dirs_pattern(chronyd_t, chronyd_tmp_t, chronyd_tmp_t)
manage_files_pattern(chronyd_t, chronyd_tmp_t, chronyd_tmp_t)
manage_sock_files_pattern(chronyd_t, chronyd_tmp_t, chronyd_tmp_t)
files_tmp_filetrans(chronyd_t, chronyd_tmp_t, { dir file sock_file })

kernel_read_system_state(chronyd_t)
kernel_read_network_state(chronyd_t)
kernel_request_load_module(chronyd_t)

can_exec(chronyd_t,chronyc_exec_t)

clock_read_adjtime(chronyd_t)

corenet_all_recvfrom_unlabeled(chronyd_t)
corenet_all_recvfrom_netlabel(chronyd_t)
corenet_udp_sendrecv_generic_if(chronyd_t)
corenet_udp_sendrecv_generic_node(chronyd_t)
corenet_udp_bind_generic_node(chronyd_t)

corenet_sendrecv_ntp_server_packets(chronyd_t)
corenet_sendrecv_ntp_client_packets(chronyd_t)
corenet_udp_bind_ntp_port(chronyd_t)
corenet_udp_bind_ptp_event_port(chronyd_t)
corenet_udp_sendrecv_ntp_port(chronyd_t)

corenet_sendrecv_chronyd_server_packets(chronyd_t)
corenet_sendrecv_chronyd_client_packets(chronyd_t)
corenet_udp_bind_chronyd_port(chronyd_t)
corenet_udp_sendrecv_chronyd_port(chronyd_t)

corenet_tcp_bind_ntske_port(chronyd_t)
corenet_tcp_connect_ntske_port(chronyd_t)

domain_dontaudit_getsession_all_domains(chronyd_t)
userdom_dontaudit_list_user_home_dirs(chronyd_t)

dev_read_rand(chronyd_t)
dev_read_urand(chronyd_t)
dev_read_sysfs(chronyd_t)

dev_rw_realtime_clock(chronyd_t)

auth_use_nsswitch(chronyd_t)

corecmd_exec_bin(chronyd_t)
corecmd_exec_shell(chronyd_t)

logging_send_syslog_msg(chronyd_t)

mta_send_mail(chronyd_t)

sysnet_read_dhcpc_state(chronyd_t)

systemd_exec_systemctl(chronyd_t)

userdom_dgram_send(chronyd_t)

optional_policy(`
	cloudform_init_dgram_send(chronyd_t)
')

optional_policy(`
    cron_dgram_send(chronyd_t)
')

optional_policy(`
	dbus_system_bus_client(chronyd_t)
')

optional_policy(`
	gpsd_rw_shm(chronyd_t)
')

optional_policy(`
    virt_read_lib_files(chronyd_t)
')

optional_policy(`
    timemaster_stream_connect(chronyd_t)
    timemaster_read_pid_files(chronyd_t)
    timemaster_rw_shm(chronyd_t)
')

optional_policy(`
    ptp4l_rw_shm(chronyd_t)
    phc2sys_rw_shm(chronyd_t)
')

optional_policy(`
    realmd_dgram_send(chronyd_t)
')

optional_policy(`
	rhcd_dgram_send(chronyd_t)
')

optional_policy(`
    rolekit_dgram_send(chronyd_t)
')

optional_policy(`
	sosreport_dgram_send(chronyd_t)
')

optional_policy(`
	unconfined_dgram_send(chronyd_t)
')

########################################
#
# Policy for chronyd-restricted
#

allow chronyd_restricted_t self:capability sys_time;
allow chronyd_restricted_t self:tcp_socket create_stream_socket_perms;
allow chronyd_restricted_t self:udp_socket create_socket_perms;
allow chronyd_restricted_t self:unix_dgram_socket create_socket_perms;

allow chronyd_restricted_t chronyd_keys_t:file read_file_perms;

manage_files_pattern(chronyd_restricted_t, chronyd_var_lib_t, chronyd_var_lib_t)

allow chronyd_restricted_t chronyd_var_log_t:dir getattr_dir_perms;

manage_files_pattern(chronyd_restricted_t, chronyd_var_run_t, chronyd_var_run_t)
list_dirs_pattern(chronyd_restricted_t, chronyd_var_run_t, chronyd_var_run_t)
manage_sock_files_pattern(chronyd_restricted_t, chronyd_var_run_t, chronyd_var_run_t)
files_pid_filetrans(chronyd_restricted_t, chronyd_var_run_t, { file sock_file })

corenet_tcp_bind_generic_node(chronyd_restricted_t)
corenet_udp_bind_generic_node(chronyd_restricted_t)

corenet_udp_bind_chronyd_port(chronyd_restricted_t)
corenet_udp_bind_ntp_port(chronyd_restricted_t)
corenet_tcp_bind_ntske_port(chronyd_restricted_t)
corenet_tcp_connect_ntske_port(chronyd_restricted_t)
corenet_udp_bind_ptp_event_port(chronyd_restricted_t)

optional_policy(`
	auth_read_passwd(chronyd_restricted_t)
')

optional_policy(`
	logging_send_syslog_msg(chronyd_restricted_t)
')

optional_policy(`
	miscfiles_read_certs(chronyd_restricted_t)
')

optional_policy(`
	sysnet_dns_name_resolve(chronyd_restricted_t)
')

########################################
#
# Local policy
#

allow chronyc_t self:capability { dac_read_search dac_override };
allow chronyc_t self:udp_socket create_socket_perms;
allow chronyc_t self:unix_dgram_socket create_socket_perms;
allow chronyc_t self:netlink_route_socket create_netlink_socket_perms;

allow chronyc_t chronyd_t:unix_dgram_socket sendto;

allow chronyc_t chronyd_keys_t:file manage_file_perms;

manage_dirs_pattern(chronyc_t, chronyd_var_run_t, chronyd_var_run_t)
manage_files_pattern(chronyc_t, chronyd_var_run_t, chronyd_var_run_t)
manage_sock_files_pattern(chronyc_t, chronyd_var_run_t, chronyd_var_run_t)

manage_dirs_pattern(chronyc_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
manage_files_pattern(chronyc_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
fs_tmpfs_filetrans(chronyc_t, chronyd_tmpfs_t, { dir file })

manage_files_pattern(chronyc_t, chronyd_var_lib_t, chronyd_var_lib_t)
files_var_lib_filetrans(chronyc_t, chronyd_var_lib_t, file)

manage_files_pattern(chronyc_t, chronyd_var_log_t, chronyd_var_log_t)
logging_log_filetrans(chronyc_t, chronyd_var_log_t, file)

manage_dirs_pattern(chronyc_t, chronyd_tmp_t, chronyd_tmp_t)
manage_files_pattern(chronyc_t, chronyd_tmp_t, chronyd_tmp_t)
manage_sock_files_pattern(chronyc_t, chronyd_tmp_t, chronyd_tmp_t)
userdom_user_tmp_filetrans(chronyc_t, chronyd_tmp_t, { dir sock_file })
files_tmp_filetrans(chronyc_t, chronyd_tmp_t, file)

kernel_read_system_state(chronyc_t)
kernel_read_network_state(chronyc_t)
kernel_read_net_sysctls(chronyc_t)

auth_use_nsswitch(chronyc_t)

corecmd_exec_bin(chronyc_t)

files_rw_inherited_non_security_files(chronyc_t)
files_append_non_security_files(chronyc_t)

sysnet_read_config(chronyc_t)

userdom_use_user_ptys(chronyc_t)
userdom_use_inherited_user_ttys(chronyc_t)
userdom_rw_stream(chronyc_t)
userdom_users_dgram_send(chronyc_t)

optional_policy(`
    nscd_shm_use(chronyc_t)
')

optional_policy(`
	term_use_generic_ptys(chronyc_t)
')