## <summary>SELinux policy for systemd components</summary>

######################################
## <summary>
##  Creates types and rules for a basic
##  systemd domains.
## </summary>
## <param name="prefix">
##  <summary>
##  Prefix for the domain.
##  </summary>
## </param>
#
template(`systemd_domain_template',`
    gen_require(`
        attribute systemd_domain;
    ')

    type $1_t, systemd_domain;
    type $1_exec_t;
    init_daemon_domain($1_t, $1_exec_t)
    init_nnp_daemon_domain($1_t)

    kernel_read_system_state($1_t)

    auth_use_nsswitch($1_t)
    selinux_get_enforce_mode($1_t)
')

######################################
## <summary>
##  Creates types and rules for 
##  systemd generators.
## </summary>
## <param name="prefix">
##  <summary>
##  Prefix for the domain.
##  </summary>
## </param>
#
template(`systemd_generator_template',`
	gen_require(`
		attribute systemd_generator;
	')

	type $1_t, systemd_generator;
	type $1_exec_t;
	init_daemon_domain($1_t, $1_exec_t)
	init_nnp_daemon_domain($1_t)

	kernel_read_system_state($1_t)
	
	dev_write_kmsg($1_t)

	auth_use_nsswitch($1_t)
	selinux_get_enforce_mode($1_t)

	systemd_manage_unit_dirs($1_t)
	systemd_create_unit_file_dirs($1_t)
	systemd_create_unit_file_lnk($1_t)
')

######################################
## <summary>
##      Create a domain for processes which are started 
##      exuting systemctl.
## </summary>
## <param name="domain_prefix">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_stub_unit_file',`
        gen_require(`
                type systemd_unit_file_t;
        ')
')

########################################
## <summary>
##      Common permissions for domains executing systemctl. (INTERNAL)
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_systemctl_common',`
	fs_list_cgroup_dirs($1)
	fs_read_cgroup_files($1)
	fs_read_efivarfs_files($1)
	systemd_list_unit_dirs($1)
	init_list_pid_dirs($1)
	init_read_state($1)
	init_stream_send($1)
	init_stream_connect($1)

	# systemctl tries to adjust its RLIMIT_NOFILE right when it is started
	dontaudit $1 self:process setrlimit;
	dontaudit $1 self:capability sys_resource;
')

#######################################
## <summary>
##      Create a domain for processes which are started 
##      exuting systemctl.
## </summary>
## <param name="domain_prefix">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
template(`systemd_systemctl_domain',`
        gen_require(`
                type systemd_systemctl_exec_t;
                role system_r;
		attribute systemctl_domain;
        ')

	type $1_systemctl_t, systemctl_domain;
	domain_type($1_systemctl_t)
	domain_entry_file($1_systemctl_t, systemd_systemctl_exec_t)	

	role system_r types $1_systemctl_t;

	domtrans_pattern($1_t, systemd_systemctl_exec_t , $1_systemctl_t)

	systemd_systemctl_common($1_systemctl_t)
')

########################################
## <summary>
##      Execute systemctl in the caller domain.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_exec_systemctl',`
        gen_require(`
                type systemd_systemctl_exec_t;
        ')

	corecmd_search_bin($1)
	can_exec($1, systemd_systemctl_exec_t)

	systemd_systemctl_common($1)

	systemd_login_list_pid_dirs($1)
	systemd_login_read_pid_files($1)
	systemd_passwd_agent_exec($1)

	dontaudit $1 self:capability { net_admin sys_ptrace };
')
#
########################################
## <summary>
##	Allow systemd_systemctl_exec_t to be an entrypoint
##	of the specified domain
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`systemd_systemctl_entrypoint',`
	gen_require(`
		type systemd_systemctl_exec_t;
	')
	allow $1 systemd_systemctl_exec_t:file entrypoint;
')

#######################################
## <summary>
##	Execute systemctl in the specified domain
## </summary>
## <param name="domain">
## 	<summary>
##	Domain allowed access.
## 	</summary>
## </param>
## <param name="target_domain">
##      <summary>
##      Domain to transition to.
##      </summary>
## </param>
#
interface(`systemd_domtrans_systemctl',`
	gen_require(`
		type systemd_systemctl_exec_t;
	')

	domain_auto_transition_pattern($1, systemd_systemctl_exec_t, $2)
')

#######################################
## <summary>
##      Create a file type used for systemd unit files.
## </summary>
## <param name="script_file">
##      <summary>
##      Type to be used for an unit file.
##      </summary>
## </param>
#
interface(`systemd_unit_file',`
        gen_require(`
                attribute systemd_unit_file_type;
        ')

        typeattribute $1 systemd_unit_file_type;
	files_type($1)
')

######################################
## <summary>
##      Allow domain to search systemd unit dirs.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_search_unit_dirs',`
        gen_require(`
                attribute systemd_unit_file_type;
        ')
	
	files_search_var_lib($1)
	allow $1 systemd_unit_file_type:dir search_dir_perms;
')

######################################
## <summary>
##      Allow domain to list systemd unit dirs.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_list_unit_dirs',`
        gen_require(`
                attribute systemd_unit_file_type;
        ')
	
	files_search_var_lib($1)
	allow $1 systemd_unit_file_type:dir list_dir_perms;
')

######################################
## <summary>
##      Allow domain to list systemd unit dirs.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_create_unit_dirs',`
        gen_require(`
                attribute systemd_unit_file_type;
        ')
	
	files_search_var_lib($1)
	allow $1 systemd_unit_file_type:dir create;
')

#####################################
## <summary>
##      Allow domain to getattr all systemd unit files.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_getattr_unit_files',`
        gen_require(`
                attribute systemd_unit_file_type;
        ')

    files_search_var_lib($1)
    getattr_files_pattern($1, systemd_unit_file_type, systemd_unit_file_type)
')

#####################################
## <summary>
##      Allow domain to getattr all systemd unit directories.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_getattr_unit_dirs',`
        gen_require(`
                attribute systemd_unit_file_type;
        ')

    allow $1 systemd_unit_file_type:dir getattr;
')

######################################
## <summary>
##      Allow domain to read all systemd unit files.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_read_unit_files',`
        gen_require(`
                attribute systemd_unit_file_type;
        ')
	
	files_search_var_lib($1)
	allow $1 systemd_unit_file_type:file read_file_perms;
	allow $1 systemd_unit_file_type:lnk_file read_lnk_file_perms;
	allow $1 systemd_unit_file_type:dir list_dir_perms;
')

#####################################
## <summary>
##      Dontaudit domain to read all systemd unit files.
## </summary>
## <param name="domain">
##      <summary>
##	Domain to not audit.
##      </summary>
## </param>
#
interface(`systemd_dontaudit_read_unit_files',`
        gen_require(`
                attribute systemd_unit_file_type;
        ')

        dontaudit $1 systemd_unit_file_type:file read_file_perms;
        dontaudit $1 systemd_unit_file_type:dir list_dir_perms;
')

######################################
## <summary>
##	Read systemd_login PID files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_login_read_pid_files',`
	gen_require(`
		type systemd_logind_var_run_t;
	')

	files_search_pids($1)
	read_files_pattern($1, systemd_logind_var_run_t, systemd_logind_var_run_t)
')

######################################
## <summary>
##	Read systemd_resolved PID files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_resolved_read_pid',`
	gen_require(`
		type systemd_resolved_var_run_t;
	')

	files_search_pids($1)
	list_dirs_pattern($1, systemd_resolved_var_run_t, systemd_resolved_var_run_t)
	read_files_pattern($1, systemd_resolved_var_run_t, systemd_resolved_var_run_t)
	read_lnk_files_pattern($1, systemd_resolved_var_run_t, systemd_resolved_var_run_t)
')

######################################
## <summary>
##	Write to systemd_resolved PID socket files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_resolved_write_pid_sock_files',`
	gen_require(`
		type systemd_resolved_var_run_t;
	')

	files_search_pids($1)
	write_sock_files_pattern($1, systemd_resolved_var_run_t, systemd_resolved_var_run_t)
')

######################################
## <summary>
##	Watch systemd_resolved PID directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_resolved_watch_pid_dirs',`
	gen_require(`
		type systemd_resolved_var_run_t;
	')

	files_search_pids($1)
	allow $1 systemd_resolved_var_run_t:dir watch_dir_perms;
')

########################################
## <summary>
##	Create objects in /var/run/systemd/resolve with a private
##	type using a type_transition.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="file_type">
##	<summary>
##	Private file type.
##	</summary>
## </param>
## <param name="class">
##	<summary>
##	Object classes to be created.
##	</summary>
## </param>
## <param name="name" optional="true">
##	<summary>
##	The name of the object being created.
##	</summary>
## </param>
#
interface(`systemd_resolved_pid_filetrans',`
	gen_require(`
		type systemd_resolved_var_run_t;
	')

	filetrans_pattern($1, systemd_resolved_var_run_t, $2, $3, $4)
')

######################################
## <summary>
##	Read systemd_login PID files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_login_manage_pid_files',`
	gen_require(`
		type systemd_logind_var_run_t;
	')

	files_search_pids($1)
	manage_files_pattern($1, systemd_logind_var_run_t, systemd_logind_var_run_t)
')


######################################
## <summary>
##	Read systemd_login PID files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_login_filetrans_pid_files',`
	gen_require(`
		type systemd_logind_var_run_t;
	')

	files_pid_filetrans($1, systemd_logind_var_run_t, file, "nologin")
')

######################################
## <summary>
##	Read systemd_login PID files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_login_list_pid_dirs',`
	gen_require(`
		type systemd_logind_var_run_t;
	')

	files_search_pids($1)
	list_dirs_pattern($1, systemd_logind_var_run_t, systemd_logind_var_run_t)
')

######################################
## <summary>
##	Watch systemd_login PID directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_login_watch_pid_dirs',`
	gen_require(`
		type systemd_logind_var_run_t;
	')

	files_search_pids($1)
	allow $1 systemd_logind_var_run_t:dir watch_dir_perms;
')

######################################
## <summary>
##	Watch systemd_login session directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_login_watch_session_dirs',`
	gen_require(`
		type systemd_logind_sessions_t;
	')

	init_search_pid_dirs($1)
	allow $1 systemd_logind_sessions_t:dir watch_dir_perms;
')

######################################
## <summary>
##	Mounton systemd_login PID files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_login_mounton_pid_dirs',`
	gen_require(`
		type systemd_logind_var_run_t;
	')

    allow $1 systemd_logind_var_run_t:dir mounton;
')

######################################
## <summary>
##	Use and and inherited systemd
##	logind file descriptors.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_use_fds_logind',`
	gen_require(`
		type systemd_logind_t;
	')

	allow $1 systemd_logind_t:fd use;
')

########################################
## <summary>
##	Read the process state (/proc/pid) of systemd_logind_t.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_logind_read_state',`
	gen_require(`
		type systemd_logind_t;
	')

	allow $1 systemd_logind_t:dir search_dir_perms;
	allow $1 systemd_logind_t:file read_file_perms;
	allow $1 systemd_logind_t:lnk_file read_lnk_file_perms;
')

######################################
## <summary>
##	Read logind sessions files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_read_logind_sessions_files',`
	gen_require(`
		type systemd_logind_sessions_t;
	')

	init_search_pid_dirs($1)
	allow $1 systemd_logind_sessions_t:dir list_dir_perms;
	read_files_pattern($1, systemd_logind_sessions_t, systemd_logind_sessions_t)
')

######################################
## <summary>
##	Mounton inherited logind sessions pipes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_mounton_inherited_logind_sessions_dirs',`
	gen_require(`
		type systemd_logind_sessions_t;
	')

	allow $1 systemd_logind_sessions_t:dir mounton;
')

######################################
## <summary>
##	Write inherited logind sessions pipes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_write_inherited_logind_sessions_pipes',`
	gen_require(`
		type systemd_logind_sessions_t;
		type systemd_logind_t;
	')

	allow $1 systemd_logind_t:fd use;
	allow $1 systemd_logind_sessions_t:fifo_file write;
')

######################################
## <summary>
##	Dontaudit attempts to write inherited logind sessions pipes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`systemd_dontaudit_write_inherited_logind_sessions_pipes',`
	gen_require(`
		type systemd_logind_sessions_t;
	')

	dontaudit $1 systemd_logind_sessions_t:fifo_file write;
')

######################################
## <summary>
##	Write systemd inhibit pipes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_write_inhibit_pipes',`
	gen_require(`
		type systemd_logind_inhibit_var_run_t;
	')

	allow $1 systemd_logind_inhibit_var_run_t:fifo_file write;
')

########################################
## <summary>
##	Allow process to mount directory with inhibit pipes
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`systemd_mounton_inhibit_dir',`
    gen_require(`
		type systemd_logind_inhibit_var_run_t;
    ')

    allow $1 systemd_logind_inhibit_var_run_t:dir mounton;
')

########################################
## <summary>
##	Send and receive messages from
##	systemd logind over dbus.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_dbus_chat_logind',`
	gen_require(`
		type systemd_logind_t;
		class dbus send_msg;
	')

	allow $1 systemd_logind_t:dbus send_msg;
	allow systemd_logind_t $1:dbus send_msg;
	ps_process_pattern(systemd_logind_t, $1)
	allow systemd_logind_t $1:process signal;
	allow $1 systemd_logind_t:fd use;
')

#######################################
## <summary>
##  Execute a domain transition to run systemd-sysctl.
## </summary>
## <param name="domain">
## <summary>
##  Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_domtrans_sysctl',`
    gen_require(`
        type systemd_sysctl_t, systemd_sysctl_exec_t;
    ')

    domtrans_pattern($1, systemd_sysctl_exec_t, systemd_sysctl_t)
')

#######################################
## <summary>
##  Allow a domain to execute systemd-sysctl in the caller domain.
## </summary>
## <param name="domain">
## <summary>
##  Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_exec_sysctl',`
    gen_require(`
        type systemd_sysctl_exec_t;
    ')

    can_exec($1,systemd_sysctl_exec_t)

')

#######################################
## <summary>
##  Allow a domain to execute systemd-sysctl in the caller domain.
## </summary>
## <param name="domain">
## <summary>
##  Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_tmpfiles_exec',`
    gen_require(`
        type systemd_tmpfiles_exec_t;
    ')

    can_exec($1,systemd_tmpfiles_exec_t)

')

#######################################
## <summary>
##  Execute a domain transition to run systemd-tmpfiles.
## </summary>
## <param name="domain">
## <summary>
##  Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_tmpfiles_domtrans',`
    gen_require(`
        type systemd_tmpfiles_t, systemd_tmpfiles_exec_t;
    ')

    domtrans_pattern($1, systemd_tmpfiles_exec_t, systemd_tmpfiles_t)
')

#######################################
## <summary>
##	Allow caller nnp_transition to systemd_tmpfiles_t
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_tmpfiles_nnp_domtrans',`
	gen_require(`
		type systemd_tmpfiles_t;
	')

	allow $1 systemd_tmpfiles_t:process2 nnp_transition;
')

#######################################
## <summary>
##  Execute a domain transition to run systemd-localed.
## </summary>
## <param name="domain">
## <summary>
##  Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_localed_domtrans',`
    gen_require(`
        type systemd_localed_t, systemd_localed_exec_t;
    ')

    domtrans_pattern($1, systemd_localed_exec_t, systemd_localed_t)
')

########################################
## <summary>
##	Execute a domain transition to run systemd-tty-ask-password-agent.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_passwd_agent_domtrans',`
	gen_require(`
		type systemd_passwd_agent_t, systemd_passwd_agent_exec_t;
	')

	domtrans_pattern($1, systemd_passwd_agent_exec_t, systemd_passwd_agent_t)
')

#######################################
## <summary>
##  Execute systemd-tty-ask-password-agent in the caller domain
## </summary>
## <param name="domain">
## <summary>
##  Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_passwd_agent_exec',`
	gen_require(`
		type systemd_passwd_agent_t, systemd_passwd_agent_exec_t;
	')

	can_exec($1, systemd_passwd_agent_exec_t)
	systemd_manage_passwd_run($1)
')

########################################
## <summary>
##	Execute a domain transition to run systemd_rfkill.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_rfkill_domtrans',`
	gen_require(`
		type systemd_rfkill_t, systemd_rfkill_exec_t;
	')

	domtrans_pattern($1, systemd_rfkill_exec_t, systemd_rfkill_t)
')

########################################
## <summary>
##	Mounton rfkill lib  directory.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_rfkill_mounton_var_lib',`
	gen_require(`
		type systemd_rfkill_var_lib_t;
	')

	allow $1 systemd_rfkill_var_lib_t:dir mounton;
')

########################################
## <summary>
##      Read systemd-rfkill lib files.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_rfkill_setattr_lib',`
        gen_require(`
                type systemd_rfkill_var_lib_t;
        ')

        files_search_var_lib($1)
        setattr_dirs_pattern($1, systemd_rfkill_var_lib_t, systemd_rfkill_var_lib_t)
')

########################################
## <summary>
##	read systemd rfkill dir
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_rfkill_read_lib_dirs',`
	gen_require(`
		type systemd_rfkill_var_lib_t;
	')

	list_dirs_pattern($1, systemd_rfkill_var_lib_t, systemd_rfkill_var_lib_t)
')

########################################
## <summary>
##	manage systemd rfkill dir
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_rfkill_manage_lib_dirs',`
	gen_require(`
		type systemd_rfkill_var_lib_t;
	')

	manage_dirs_pattern($1, systemd_rfkill_var_lib_t, systemd_rfkill_var_lib_t)
')

########################################
## <summary>
##	Mounton systemd timesync directory.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_timedated_mounton_var_lib',`
	gen_require(`
		type systemd_timedated_var_lib_t;
	')

	allow $1 systemd_timedated_var_lib_t:dir mounton;
')

#######################################
## <summary>
##  Get timedated service status
## </summary>
## <param name="domain">
##  <summary>
##  Domain allowed to transition.
##  </summary>
## </param>
#
interface(`systemd_timedated_status',`
    gen_require(`
        type systemd_timedated_unit_file_t;
    ')

    allow $1 systemd_timedated_unit_file_t:service status;
')

########################################
## <summary>
##	manage systemd timesync dir
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_timedated_manage_lib_dirs',`
	gen_require(`
		type systemd_timedated_var_lib_t;
	')

	manage_dirs_pattern($1, systemd_timedated_var_lib_t, systemd_timedated_var_lib_t)
	read_lnk_files_pattern($1, systemd_timedated_var_lib_t, systemd_timedated_var_lib_t)
')

########################################
## <summary>
##	Execute systemd-notify in the caller domain
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_exec_notify',`
	gen_require(`
		type systemd_notify_exec_t;
	')

	can_exec($1, systemd_notify_exec_t)
')

########################################
## <summary>
##	Execute a domain transition to run systemd_notify.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_notify_domtrans',`
	gen_require(`
		type systemd_notify_t, systemd_notify_exec_t;
	')

	domtrans_pattern($1, systemd_notify_exec_t, systemd_notify_t)
')

########################################
## <summary>
##	Execute systemd-tty-ask-password-agent in the systemd_passwd_agent domain, and
##	allow the specified role the systemd_passwd_agent domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	The role to be allowed the systemd_passwd_agent domain.
##	</summary>
## </param>
#
interface(`systemd_passwd_agent_run',`
	gen_require(`
		type systemd_passwd_agent_t;
	')

	systemd_passwd_agent_domtrans($1)
	role $2 types systemd_passwd_agent_t;
')

########################################
## <summary>
##	Execute systemd-tmpfiles in the systemd_tmpfiles_t domain, and
##	allow the specified role the systemd_tmpfiles domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	The role to be allowed the systemd_tmpfiles domain.
##	</summary>
## </param>
#
interface(`systemd_tmpfiles_run',`
	gen_require(`
		type systemd_tmpfiles_t;
	')

	systemd_tmpfiles_domtrans($1)
	role $2 types systemd_tmpfiles_t;
')

########################################
## <summary>
##	Role access for systemd_passwd_agent
## </summary>
## <param name="role">
##	<summary>
##	Role allowed access
##	</summary>
## </param>
## <param name="domain">
##	<summary>
##	User domain for the role
##	</summary>
## </param>
#
interface(`systemd_passwd_agent_role',`
	gen_require(`
              type systemd_passwd_agent_t;
	')

	role $1 types systemd_passwd_agent_t;

	systemd_passwd_agent_domtrans($2)

	ps_process_pattern($2, systemd_passwd_agent_t)
	allow $2 systemd_passwd_agent_t:process signal;
')

########################################
## <summary>
##	Send generic signals to systemd_passwd_agent processes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_signal_passwd_agent',`
	gen_require(`
              type systemd_passwd_agent_t;
	')

	allow $1 systemd_passwd_agent_t:process signal;
')

######################################
## <summary>
##  Allow to domain to read systemd-passwd pipe
## </summary>
## <param name="domain">
##  <summary>
##  Domain allowed access.
##  </summary>
## </param>
#
interface(`systemd_read_fifo_file_passwd_run',`
    gen_require(`
        type systemd_passwd_var_run_t;
    ')

    init_search_pid_dirs($1)
    read_sock_files_pattern($1, systemd_passwd_var_run_t, systemd_passwd_var_run_t)
')

########################################
## <summary>
##	Relabel to user home directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_relabelto_fifo_file_passwd_run',`
	gen_require(`
	        type systemd_passwd_var_run_t;
	')

	allow $1 systemd_passwd_var_run_t:fifo_file relabelto;
')

########################################
## <summary>
##	Watch systemd-passwd pid dirs
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_passwd_watch_pid_dirs',`
	gen_require(`
	        type systemd_passwd_var_run_t;
	')

	allow $1 systemd_passwd_var_run_t:dir watch_dir_perms;
')

#######################################
## <summary>
##      Relabel systemd unit directories
## </summary>
## <param name="script_file">
##      <summary>
##  	Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_relabel_unit_dirs',`
        gen_require(`
                attribute systemd_unit_file_type;
        ')

	relabel_dirs_pattern($1, systemd_unit_file_type, systemd_unit_file_type)
')

#######################################
## <summary>
##      Relabel systemd unit files
## </summary>
## <param name="script_file">
##      <summary>
##  	Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_relabel_unit_files',`
        gen_require(`
                attribute systemd_unit_file_type;
        ')

	relabel_files_pattern($1, systemd_unit_file_type, systemd_unit_file_type)
')

#######################################
## <summary>
##      Relabel systemd unit link files
## </summary>
## <param name="script_file">
##      <summary>
##  	Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_relabel_unit_symlinks',`
        gen_require(`
                attribute systemd_unit_file_type;
        ')

	relabel_lnk_files_pattern($1, systemd_unit_file_type, systemd_unit_file_type)
')

#######################################
## <summary>
##  Send generic signals to systemd_passwd_agent processes.
## </summary>
## <param name="domain">
##  <summary>
##  Domain allowed access.
##  </summary>
## </param>
#
interface(`systemd_manage_passwd_run',`
	gen_require(`
		type systemd_passwd_agent_t;	
		type systemd_passwd_var_run_t;
	')

	init_search_pid_dirs($1)
	manage_files_pattern($1, systemd_passwd_var_run_t, systemd_passwd_var_run_t)
	manage_sock_files_pattern($1, systemd_passwd_var_run_t, systemd_passwd_var_run_t)
	manage_fifo_files_pattern($1, systemd_passwd_var_run_t, systemd_passwd_var_run_t)

	allow systemd_passwd_agent_t $1:process signull;
	allow systemd_passwd_agent_t $1:unix_dgram_socket sendto;
')

######################################
## <summary>
##  Template for temporary sockets and files in /dev/.systemd/ask-password
##  which are used by systemd-passwd-agent
## </summary>
## <param name="userdomain_prefix">
##  <summary>
##  The prefix of the domain (e.g., user
##  is the prefix for user_t).
##  </summary>
## </param>
#
interface(`systemd_passwd_agent_dev_template',`
        gen_require(`
                type systemd_passwd_agent_t;
        ')

	type systemd_$1_device_t;
        files_type(systemd_$1_device_t)
        dev_associate(systemd_$1_device_t)

	dev_filetrans($1_t, systemd_$1_device_t, { file sock_file })
	init_pid_filetrans($1_t, systemd_$1_device_t, { file sock_file })
        allow $1_t systemd_$1_device_t:file manage_file_perms;
        allow $1_t systemd_$1_device_t:sock_file manage_sock_file_perms;

	allow systemd_passwd_agent_t $1_t:process signull;
        allow systemd_passwd_agent_t $1_t:unix_dgram_socket sendto;
	allow systemd_passwd_agent_t systemd_$1_device_t:sock_file write;
        allow systemd_passwd_agent_t systemd_$1_device_t:file read_file_perms;
')

########################################
## <summary>
##	Allow the specified domain to connect to
##	systemd_logger with a unix socket.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_logger_stream_connect',`
	gen_require(`
		type systemd_logger_t;
	')

	allow $1 systemd_logger_t:unix_stream_socket connectto;
')

########################################
## <summary>
##	manage systemd unit dirs
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_manage_unit_dirs',`
	gen_require(`
		attribute systemd_unit_file_type;
	')

	manage_dirs_pattern($1, systemd_unit_file_type, systemd_unit_file_type)
')

########################################
## <summary>
##	manage systemd unit link files
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_manage_unit_symlinks',`
	gen_require(`
		attribute systemd_unit_file_type;
	')

	manage_lnk_files_pattern($1, systemd_unit_file_type, systemd_unit_file_type)
')

########################################
## <summary>
##	manage all systemd unit files
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_manage_all_unit_files',`
	gen_require(`
		attribute systemd_unit_file_type;
	')

	manage_files_pattern($1, systemd_unit_file_type, systemd_unit_file_type)
	manage_lnk_files_pattern($1, systemd_unit_file_type, systemd_unit_file_type)
')

########################################
## <summary>
##	manage all systemd unit lnk_files
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_manage_all_unit_lnk_files',`
	gen_require(`
		attribute systemd_unit_file_type;
	')

	manage_lnk_files_pattern($1, systemd_unit_file_type, systemd_unit_file_type)
')

########################################
## <summary>
##	Allow the specified domain to start all systemd services.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_start_all_services',`
	gen_require(`
		attribute systemd_unit_file_type;
	')

	allow $1 systemd_unit_file_type:service start;
')

#######################################
## <summary>
##  Allow the specified domain to reload all systemd services.
## </summary>
## <param name="domain">
##  <summary>
##  Domain allowed access.
##  </summary>
## </param>
#
interface(`systemd_reload_all_services',`
    gen_require(`
        attribute systemd_unit_file_type;
    ')

    allow $1 systemd_unit_file_type:service reload;
')

########################################
## <summary>
##	Allow the specified domain to modify the systemd configuration of 
##	all systemd services
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_config_all_services',`
	gen_require(`
		attribute systemd_unit_file_type;
	')

	allow $1 systemd_unit_file_type:service all_service_perms;
	init_config_all_script_files($1)
')

########################################
## <summary>
##	Allow the specified domain to start systemd services.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_start_systemd_services',`
	gen_require(`
		type systemd_unit_file_t;
	')

	allow $1 systemd_unit_file_t:service start;
')

########################################
## <summary>
##	Allow the specified domain to stop systemd services.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_stop_systemd_services',`
	gen_require(`
		type systemd_unit_file_t;
	')

	allow $1 systemd_unit_file_t:service stop;
')

########################################
## <summary>
##	Allow the specified domain to status systemd services.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_status_systemd_services',`
	gen_require(`
		type systemd_unit_file_t;
	')

	allow $1 systemd_unit_file_t:service status;
')

#######################################
## <summary>
##  Allow the specified domain to reload all systemd services.
## </summary>
## <param name="domain">
##  <summary>
##  Domain allowed access.
##  </summary>
## </param>
#
interface(`systemd_reload_systemd_services',`
    gen_require(`
        type systemd_unit_file_t;
    ')

    allow $1 systemd_unit_file_t:service reload;
')

########################################
## <summary>
##	Allow the specified domain to modify the systemd configuration of 
##	all systemd services
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_config_systemd_services',`
	gen_require(`
		type systemd_unit_file_t;
	')

	allow $1 systemd_unit_file_t:service all_service_perms;
	init_config_all_script_files($1)
')

########################################
## <summary>
##	manage all systemd random seed file
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_manage_random_seed',`
	gen_require(`
		type random_seed_t;
	')

	allow $1 random_seed_t:file manage_file_perms;
	files_var_lib_filetrans($1, random_seed_t, file, "random_seed")
')

########################################
## <summary>
##	Allow process to read hostname config file.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`systemd_hostnamed_read_config',`
	gen_require(`
		type hostname_etc_t;
	')

	files_search_etc($1)
	allow $1 hostname_etc_t:file read_file_perms;
')

########################################
## <summary>
##	Allow process to manage hostname config file.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`systemd_hostnamed_manage_config',`
	gen_require(`
		type hostname_etc_t;
	')

	files_search_etc($1)
	allow $1 hostname_etc_t:file manage_file_perms;
    files_etc_filetrans($1, hostname_etc_t, file, "hostname")
')

########################################
## <summary>
##	Allow process to delete hostname config file.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_hostnamed_delete_config',`
	gen_require(`
		type hostname_etc_t;
	')

	init_delete_pid_dir_entry($1)
	allow $1 hostname_etc_t:file delete_file_perms;
')

#######################################
## <summary>
##  Create objects in /run/systemd/generator directory
##  with an automatic type transition to
##  a specified private type.
## </summary>
## <param name="domain">
##  <summary>
##  Domain allowed access.
##  </summary>
## </param>
## <param name="private_type">
##  <summary>
##  The type of the object to create.
##  </summary>
## </param>
## <param name="object_class">
##  <summary>
##  The class of the object to be created.
##  </summary>
## </param>
## <param name="name" optional="true">
##	<summary>
##	The name of the object being created.
##	</summary>
## </param>
#
interface(`systemd_unit_file_filetrans',`
    gen_require(`
        type systemd_unit_file_t;
    ')

	files_search_pids($1)
	filetrans_pattern($1, systemd_unit_file_t, $2, $3, $4)
')

#######################################
## <summary>
##	Get attributes of generic systemd unit files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_getattr_generic_unit_files',`
	gen_require(`
		type systemd_unit_file_t;
	')

	getattr_files_pattern($1, systemd_unit_file_t, systemd_unit_file_t)
')

#######################################
## <summary>
##	Read generic systemd unit lnk files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_read_generic_unit_lnk_files',`
	gen_require(`
		type systemd_unit_file_t;
	')

	read_lnk_files_pattern($1, systemd_unit_file_t, systemd_unit_file_t)
')

#######################################
## <summary>
##  Create a directory in the /usr/lib/systemd/system directory.
## </summary>
## <param name="domain">
##  <summary>
##  Domain allowed access.
##  </summary>
## </param>
#
interface(`systemd_create_unit_file_dirs',`
    gen_require(`
        type systemd_unit_file_t;
    ')

    create_dirs_pattern($1, systemd_unit_file_t, systemd_unit_file_t)
')

#######################################
## <summary>
##  Create a link in the /usr/lib/systemd/system directory.
## </summary>
## <param name="domain">
##  <summary>
##  Domain allowed access.
##  </summary>
## </param>
#
interface(`systemd_create_unit_file_lnk',`
    gen_require(`
        type systemd_unit_file_t;
    ')

    create_lnk_files_pattern($1, systemd_unit_file_t, systemd_unit_file_t)
')

########################################
## <summary>
##	Transition to systemd named content
## </summary>
## <param name="domain">
##	<summary>
##      Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_filetrans_named_content',`
	gen_require(`
		type systemd_passwd_var_run_t;
		type systemd_logind_var_run_t;
		type hostname_etc_t;
		type systemd_home_t;
		type systemd_rfkill_var_lib_t;
	')

	files_pid_filetrans($1, systemd_logind_var_run_t, file, "nologin")
	files_pid_filetrans($1, systemd_logind_var_run_t, file, "shutdown")
	init_named_pid_filetrans($1, hostname_etc_t, file, "default-hostname")
	init_named_pid_filetrans($1, systemd_passwd_var_run_t, dir, "ask-password-block")
	init_named_pid_filetrans($1, systemd_passwd_var_run_t, dir, "ask-password")
	files_etc_filetrans($1, hostname_etc_t, file, "hostname" )
	files_etc_filetrans($1, hostname_etc_t, file, "machine-info" )
	init_var_lib_filetrans($1, systemd_rfkill_var_lib_t, dir, "rfkill" )
')

########################################
## <summary>
##	read systemd homedir content
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_read_home_content',`
	gen_require(`
		type systemd_home_t;
	')

	optional_policy(`
		gnome_search_gconf_data_dir($1)
	')
	read_files_pattern($1, systemd_home_t, systemd_home_t)
	read_lnk_files_pattern($1, systemd_home_t, systemd_home_t)
')

########################################
## <summary>
##	Manage systemd homedir content
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_manage_home_content',`
	gen_require(`
		type systemd_home_t;
	')

	optional_policy(`
		gnome_search_gconf_data_dir($1)
	')
	manage_dirs_pattern($1, systemd_home_t, systemd_home_t)
	manage_files_pattern($1, systemd_home_t, systemd_home_t)
	manage_lnk_files_pattern($1, systemd_home_t, systemd_home_t)

	systemd_filetrans_home_content($1)
')

########################################
## <summary>
##	Transition to systemd named content
## </summary>
## <param name="domain">
##	<summary>
##      Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_filetrans_home_content',`
	gen_require(`
		type systemd_home_t;
	')

	optional_policy(`
		gnome_data_filetrans($1, systemd_home_t, dir, "systemd")
	')
')

########################################
## <summary>
##	Transition to systemd named content for /etc/hostname
## </summary>
## <param name="domain">
##	<summary>
##      Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_filetrans_named_hostname',`
	gen_require(`
		type hostname_etc_t;
	')

	files_etc_filetrans($1, hostname_etc_t, file, "hostname" )
	files_etc_filetrans($1, hostname_etc_t, file, "machine-info" )
')

########################################
## <summary>
##	Get the system status information from systemd_login
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_login_status',`
	gen_require(`
		type systemd_logind_t;
	')

	allow $1 systemd_logind_t:system status;
')

########################################
## <summary>
##	Send systemd_login a null signal.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_login_signull',`
	gen_require(`
		type systemd_logind_t;
	')

	allow $1 systemd_logind_t:process signull;
')

########################################
## <summary>
##	Send systemd_hostnamed a null signal.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_hostnamed_signull',`
	gen_require(`
		type systemd_hostnamed_t;
	')

	allow $1 systemd_hostnamed_t:process signull;
')

########################################
## <summary>
##	Tell systemd_login to reboot the system.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_login_reboot',`
	gen_require(`
		type systemd_logind_t;
	')

	allow $1 systemd_logind_t:system reboot;
')

########################################
## <summary>
##	Tell systemd_login to halt the system.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_login_halt',`
	gen_require(`
		type systemd_logind_t;
	')

	allow $1 systemd_logind_t:system halt;
')

########################################
## <summary>
##	Tell systemd_login to do an unknown access.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_login_undefined',`
	gen_require(`
		type systemd_logind_t;
	')

	allow $1 systemd_logind_t:system undefined;
')

########################################
## <summary>
##	Configure generic unit files domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
#
interface(`systemd_config_generic_services',`
	gen_require(`
		type systemd_unit_file_t;
	')

	systemd_exec_systemctl($1)
	allow $1 systemd_unit_file_t:file read_file_perms;
	allow $1 systemd_unit_file_t:service manage_service_perms;
')

########################################
## <summary>
##	Configure power unit files domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
#
interface(`systemd_config_power_services',`
	gen_require(`
		type power_unit_file_t;
	')

	systemd_exec_systemctl($1)
	allow $1 power_unit_file_t:file read_file_perms;
	allow $1 power_unit_file_t:service manage_service_perms;
')

########################################
## <summary>
##	Start power unit files domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
#
interface(`systemd_start_power_services',`
	gen_require(`
		type power_unit_file_t;
	')

	systemd_exec_systemctl($1)
	allow $1 power_unit_file_t:service start;
')

########################################
## <summary>
##	Status power unit files domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
#
interface(`systemd_status_power_services',`
	gen_require(`
		type power_unit_file_t;
	')

	systemd_exec_systemctl($1)
	allow $1 power_unit_file_t:service status;
')

########################################
## <summary>
##	Start vconsole unit.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_start_vconsole_services',`
	gen_require(`
		type systemd_vconsole_unit_file_t;
	')

	systemd_exec_systemctl($1)
	allow $1 systemd_vconsole_unit_file_t:service start;
')

########################################
## <summary>
##	Status vconsole unit.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_status_vconsole_services',`
	gen_require(`
		type systemd_vconsole_unit_file_t;
	')

	systemd_exec_systemctl($1)
	allow $1 systemd_vconsole_unit_file_t:service status;
')

#######################################
## <summary>
##  Start power unit files domain.
## </summary>
## <param name="domain">
##  <summary>
##  Domain allowed to transition.
##  </summary>
## </param>
#
interface(`systemd_start_all_unit_files',`
    gen_require(`
        attribute systemd_unit_file_type;
    ')

    systemd_exec_systemctl($1)
    allow $1 systemd_unit_file_type:service start;
')

#######################################
## <summary>
##  Start power unit files domain.
## </summary>
## <param name="domain">
##  <summary>
##  Domain allowed to transition.
##  </summary>
## </param>
#
interface(`systemd_status_all_unit_files',`
    gen_require(`
        attribute systemd_unit_file_type;
    ')

    systemd_exec_systemctl($1)
    allow $1 systemd_unit_file_type:service status;
')

########################################
## <summary>
##	Send and receive messages from
##	systemd timedated over dbus.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_dbus_chat_timedated',`
	gen_require(`
		type systemd_timedated_t;
		class dbus send_msg;
	')

	allow $1 systemd_timedated_t:dbus send_msg;
	allow systemd_timedated_t $1:dbus send_msg;
	ps_process_pattern(systemd_timedated_t, $1)
')

########################################
## <summary>
##	Send and receive messages from
##	systemd hostnamed over dbus.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_dbus_chat_hostnamed',`
	gen_require(`
		type systemd_hostnamed_t;
		class dbus send_msg;
	')

	allow $1 systemd_hostnamed_t:dbus send_msg;
	allow systemd_hostnamed_t $1:dbus send_msg;
	ps_process_pattern(systemd_hostnamed_t, $1)
')

########################################
## <summary>
##	Send and receive messages from
##	systemd localed over dbus.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_dbus_chat_localed',`
	gen_require(`
		type systemd_localed_t;
		class dbus send_msg;
	')

	allow $1 systemd_localed_t:dbus send_msg;
	allow systemd_localed_t $1:dbus send_msg;
	ps_process_pattern(systemd_localed_t, $1)
')

########################################
## <summary>
##	Dontaudit attempts to send dbus domains chat messages
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`systemd_dontaudit_dbus_chat',`
	gen_require(`
		attribute systemd_domain;
		class dbus send_msg;
	')

	dontaudit $1 systemd_domain:dbus send_msg;
')

######################################
## <summary>
##	Read systemd-machined PID files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_machined_read_pid_files',`
	gen_require(`
		type systemd_machined_var_run_t;
	')

	files_search_pids($1)
	list_dirs_pattern($1, systemd_machined_var_run_t, systemd_machined_var_run_t)
	read_files_pattern($1, systemd_machined_var_run_t, systemd_machined_var_run_t)
')

######################################
## <summary>
##	Manage systemd-machined PID files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_machined_manage_pid_files',`
	gen_require(`
		type systemd_machined_var_run_t;
	')

	files_search_pids($1)
	manage_dirs_pattern($1, systemd_machined_var_run_t, systemd_machined_var_run_t)
	manage_files_pattern($1, systemd_machined_var_run_t, systemd_machined_var_run_t)
')

######################################
## <summary>
##	List systemd-machined PID files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_machined_list_pid_dirs',`
	gen_require(`
		type systemd_machined_var_run_t;
	')

	files_search_pids($1)
	list_dirs_pattern($1, systemd_machined_var_run_t, systemd_machined_var_run_t)
')

######################################
## <summary>
##	Watch systemd-machined PID directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_machined_watch_pid_dirs',`
	gen_require(`
		type systemd_machined_var_run_t;
	')

	files_search_pids($1)
	allow $1 systemd_machined_var_run_t:dir watch_dir_perms;
')



########################################
## <summary>
##      Search systemd-machined lib directories.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_machined_search_lib',`
        gen_require(`
                type systemd_machined_var_lib_t;
        ')

        allow $1 systemd_machined_var_lib_t:dir search_dir_perms;
        files_search_var_lib($1)
')

########################################
## <summary>
##      Read systemd-machined lib files.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_machined_read_lib_files',`
        gen_require(`
                type systemd_machined_var_lib_t;
        ')

        files_search_var_lib($1)
        read_files_pattern($1, systemd_machined_var_lib_t, systemd_machined_var_lib_t)
')

########################################
## <summary>
##      Manage systemd-machined lib files.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_machined_manage_lib_files',`
        gen_require(`
                type systemd_machined_var_lib_t;
        ')

        files_search_var_lib($1)
        manage_dirs_pattern($1, systemd_machined_var_lib_t, systemd_machined_var_lib_t)
        manage_files_pattern($1, systemd_machined_var_lib_t, systemd_machined_var_lib_t)
')

########################################
## <summary>
##      Read and write systemd-machined devpts character nodes.
## </summary>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
interface(`systemd_machined_rw_devpts_chr_files',`
        gen_require(`
                type devpts_t, systemd_machined_devpts_t;
        ')

        rw_chr_files_pattern($1, devpts_t, systemd_machined_devpts_t)
')

########################################
## <summary>
##	Allow the specified domain to connect to
##	systemd_machined with a unix socket.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_machined_stream_connect',`
	gen_require(`
		type systemd_machined_t;
	')

	allow $1 systemd_machined_t:unix_stream_socket connectto;
')

########################################
## <summary>
##	Send and receive messages from
##	systemd machined over dbus.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_dbus_chat_machined',`
	gen_require(`
		type systemd_machined_t;
		class dbus send_msg;
	')

	allow $1 systemd_machined_t:dbus send_msg;
	allow systemd_machined_t $1:dbus send_msg;
	ps_process_pattern(systemd_machined_t, $1)
')

#######################################
## <summary>
##  Execute a domain transition to run systemd-coredump.
## </summary>
## <param name="domain">
## <summary>
##  Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_coredump_domtrans',`
    gen_require(`
        type systemd_coredump_t, systemd_coredump_exec_t;
    ')

    domtrans_pattern($1, systemd_coredump_exec_t, systemd_coredump_t)
')

########################################
## <summary>
##	Mmap to systemd-coredump temporary file system.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_map_coredump_tmpfs_files',`
	gen_require(`
		type systemd_coredump_tmpfs_t;
	')

	allow $1 systemd_coredump_tmpfs_t:file map;
')

########################################
## <summary>
##	Read and write to systemd-coredump temporary file system.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_rw_coredump_tmpfs_files',`
	gen_require(`
		type systemd_coredump_tmpfs_t;
	')

	allow $1 systemd_coredump_tmpfs_t:file rw_file_perms;
')

########################################
## <summary>
##	Mmap to systemd-bootchart temporary file system.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_map_bootchart_tmpfs_files',`
	gen_require(`
		type systemd_bootchart_tmpfs_t;
	')

	allow $1 systemd_bootchart_tmpfs_t:file map;
')

########################################
## <summary>
##	Read and write to systemd-bootchart temporary file system.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_rw_bootchart_tmpfs_files',`
	gen_require(`
		type systemd_bootchart_tmpfs_t;
	')

	allow $1 systemd_bootchart_tmpfs_t:file rw_file_perms;
')

########################################
## <summary>
##	Allow process to read hwdb config file.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`systemd_hwdb_read_config',`
	gen_require(`
		type systemd_hwdb_etc_t;
	')

	files_search_etc($1)
	allow $1 systemd_hwdb_etc_t:file read_file_perms;
')

########################################
## <summary>
##	Allow process to mmap hwdb config file.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`systemd_hwdb_mmap_config',`
	gen_require(`
		type systemd_hwdb_etc_t;
	')

	allow $1 systemd_hwdb_etc_t:file map;
')

########################################
## <summary>
##	Allow process to manage hwdb config file.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`systemd_hwdb_manage_config',`
	gen_require(`
		type systemd_hwdb_etc_t;
	')

	files_search_etc($1)
	manage_files_pattern($1, systemd_hwdb_etc_t, systemd_hwdb_etc_t)
	mmap_files_pattern($1, systemd_hwdb_etc_t, systemd_hwdb_etc_t)
	allow $1 systemd_hwdb_etc_t:file {relabelfrom relabelto};
	files_etc_filetrans($1, systemd_hwdb_etc_t, file, "hwdb.bin")
')

########################################
## <summary>
##	Allow process to mount directory configured in a
##  systemd unit as ReadWriteDirectory or ReadOnlyDirectory.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`systemd_allow_mount_dir',`
    gen_require(`
        attribute systemd_mount_directory;
    ')

    allow $1 systemd_mount_directory:dir { list_dir_perms mounton };
')

########################################
## <summary>
##	Allow process to create directory configured in a
##  systemd unit as ReadWriteDirectory or ReadOnlyDirectory.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`systemd_allow_create_mount_dir',`
    gen_require(`
        attribute systemd_mount_directory;
    ')

    allow $1 systemd_mount_directory:dir create_dir_perms;
')

########################################
## <summary>
##	Mark the following type as mountable by systemd.
## </summary>
## <param name="type">
##	<summary>
##	Type to be authorized to be mounted
##	</summary>
## </param>
## <rolecap/>
#
interface(`systemd_mount_dir',`
    gen_require(`
        attribute systemd_mount_directory;
    ')

    files_type($1)
    typeattribute $1 systemd_mount_directory;
')

########################################
## <summary>
##	Mmap systemd_networkd_exec_t files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_map_networkd_exec_files',`
	gen_require(`
		type systemd_networkd_exec_t;
	')

	allow $1 systemd_networkd_exec_t:file map;
')

########################################
## <summary>
##	Watch systemd_networkd PID directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_networkd_watch_pid_dirs',`
	gen_require(`
		type systemd_networkd_var_run_t;
	')

	init_search_pid_dirs($1)
	allow $1 systemd_networkd_var_run_t:dir watch_dir_perms;
')

########################################
## <summary>
##	Mmap systemd_resolved_exec_t files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_map_resolved_exec_files',`
	gen_require(`
		type systemd_resolved_exec_t;
	')

	allow $1 systemd_resolved_exec_t:file map;
')

########################################
## <summary>
##	Exchange messages with
##	systemd resolved over dbus or varlink.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_chat_resolved',`
	gen_require(`
		type systemd_resolved_t;
		class dbus send_msg;
	')

	allow $1 systemd_resolved_t:dbus send_msg;
	allow $1 systemd_resolved_t:unix_stream_socket connectto;
	allow systemd_resolved_t $1:dbus send_msg;
	ps_process_pattern(systemd_resolved_t, $1)
')

########################################
## <summary>
##	Exchange messages with
##	systemd resolved over dbus (deprecated)
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_dbus_chat_resolved',`
	refpolicywarn(`$0($*) has been deprecated, use systemd_chat_resolved() instead.')
	systemd_chat_resolved($1)
')

######################################
## <summary>
##	Make the specified type usable as a systemd private tmp type.
## </summary>
## <param name="domain">
##	<summary>
##	Type to be used as a private tmp type.
##	</summary>
## </param>
#
interface(`systemd_private_tmp',`
	gen_require(`
		attribute systemd_private_tmp_type;
	')

	typeattribute $1 systemd_private_tmp_type;
')

#######################################
## <summary>
##	Delete filesystem objects with systemd_delete_private_tmp attribute
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access
##	</summary>
## </param>
#
interface(`systemd_delete_private_tmp',`
	gen_require(`
		attribute systemd_private_tmp_type;
	')

	delete_dirs_pattern($1, systemd_private_tmp_type, systemd_private_tmp_type)
	delete_fifo_files_pattern($1, systemd_private_tmp_type, systemd_private_tmp_type)
	delete_files_pattern($1, systemd_private_tmp_type, systemd_private_tmp_type)
	delete_lnk_files_pattern($1, systemd_private_tmp_type, systemd_private_tmp_type)
	delete_sock_files_pattern($1, systemd_private_tmp_type, systemd_private_tmp_type)
')
#
######################################
## <summary>
##	Make the specified type usable as a systemd read efivarfs type.
## </summary>
## <param name="domain">
##	<summary>
##	Type to be used as a read efivarfs type.
##	</summary>
## </param>
#
interface(`systemd_read_efivarfs',`
	gen_require(`
		attribute systemd_read_efivarfs_type;
	')

	typeattribute $1 systemd_read_efivarfs_type;
')

#######################################
## <summary>
##	Create objects in the pid directory
##	with a private type with a type transition.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_userdbd_runtime_filetrans',`
	gen_require(`
		type init_var_run_t;
		type systemd_userdbd_runtime_t;
	')

	filetrans_pattern($1, init_var_run_t, systemd_userdbd_runtime_t, dir, "userdb")
')

#######################################
## <summary>
##	Read systemd-userdbd data symlinks.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_userdbd_runtime_read_symlinks',`
	gen_require(`
		type systemd_userdbd_runtime_t;
	')

	list_dirs_pattern($1, systemd_userdbd_runtime_t, systemd_userdbd_runtime_t)
	read_lnk_files_pattern($1, systemd_userdbd_runtime_t, systemd_userdbd_runtime_t)
')

#######################################
## <summary>
##	Manage systemd-userdbd data symlinks.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_userdbd_runtime_manage_symlinks',`
	gen_require(`
		type systemd_userdbd_runtime_t;
	')

	manage_lnk_files_pattern($1, systemd_userdbd_runtime_t, systemd_userdbd_runtime_t);
')

#######################################
## <summary>
##	Connect to systemd-userdbd with a unix socket.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_userdbd_stream_connect',`
	gen_require(`
		type systemd_userdbd_t;
        type systemd_userdbd_runtime_t;
	')

	files_search_pids($1)
	list_dirs_pattern($1, systemd_userdbd_runtime_t, systemd_userdbd_runtime_t)
	read_lnk_files_pattern($1, systemd_userdbd_runtime_t, systemd_userdbd_runtime_t)
	write_sock_files_pattern($1, systemd_userdbd_runtime_t, systemd_userdbd_runtime_t)

	allow $1 systemd_userdbd_t:unix_stream_socket connectto;
')

#######################################
## <summary>
##	Manage named sockets in userdbd runtime directory
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_manage_userdbd_runtime_sock_files',`
	gen_require(`
        	type systemd_userdbd_runtime_t;
	')

	manage_sock_files_pattern($1, systemd_userdbd_runtime_t, systemd_userdbd_runtime_t)
')

#######################################
## <summary>
##	Allows connections to the systemd-socket-proxyd's socket.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`systemd_connectto_socket_proxyd_unix_sockets', `
	gen_require(`
		type systemd_socket_proxyd_t;
	')

	allow $1 systemd_socket_proxyd_t:unix_stream_socket connectto;
')