policy_module(dirsrv-admin,1.0.0) 

########################################
#
# Declarations for the daemon
#

type dirsrvadmin_t;
type dirsrvadmin_exec_t;
init_daemon_domain(dirsrvadmin_t, dirsrvadmin_exec_t)
role system_r types dirsrvadmin_t;

type dirsrvadmin_config_t;
files_type(dirsrvadmin_config_t)

type dirsrvadmin_lock_t;
files_lock_file(dirsrvadmin_lock_t)

type dirsrvadmin_tmp_t;
files_tmp_file(dirsrvadmin_tmp_t)

type dirsrvadmin_unit_file_t;
systemd_unit_file(dirsrvadmin_unit_file_t)

type dirsrvadmin_unconfined_script_t;
type dirsrvadmin_unconfined_script_exec_t;
domain_type(dirsrvadmin_unconfined_script_t)
domain_entry_file(dirsrvadmin_unconfined_script_t, dirsrvadmin_unconfined_script_exec_t)
corecmd_shell_entry_type(dirsrvadmin_unconfined_script_t)
role system_r types dirsrvadmin_unconfined_script_t;

########################################
#
# Local policy for the daemon
#

allow dirsrvadmin_t self:fifo_file rw_fifo_file_perms;
allow dirsrvadmin_t self:capability { dac_read_search  sys_tty_config sys_resource };
allow dirsrvadmin_t self:process { setrlimit signal_perms };

manage_files_pattern(dirsrvadmin_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
manage_dirs_pattern(dirsrvadmin_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
files_tmp_filetrans(dirsrvadmin_t, dirsrvadmin_tmp_t, { file dir })

kernel_read_system_state(dirsrvadmin_t)

corecmd_exec_bin(dirsrvadmin_t)
corecmd_read_bin_symlinks(dirsrvadmin_t)
corecmd_search_bin(dirsrvadmin_t)
corecmd_shell_entry_type(dirsrvadmin_t)

files_exec_etc_files(dirsrvadmin_t)

libs_exec_ld_so(dirsrvadmin_t)

logging_search_logs(dirsrvadmin_t)

# Needed for stop and restart scripts
dirsrv_read_var_run(dirsrvadmin_t)

optional_policy(`
	apache_domtrans(dirsrvadmin_t)
	apache_signal(dirsrvadmin_t)
')

########################################
#
# Local policy for the CGIs
#
#
#
# Create a domain for the CGI scripts

optional_policy(`
	apache_content_template(dirsrvadmin)
	apache_content_alias_template(dirsrvadmin, dirsrvadmin)

	allow dirsrvadmin_script_t self:process { getsched getpgid };
	allow dirsrvadmin_script_t self:capability { fowner fsetid setuid net_bind_service setgid chown sys_nice kill dac_read_search  };
	allow dirsrvadmin_script_t self:tcp_socket create_stream_socket_perms;
	allow dirsrvadmin_script_t self:udp_socket create_socket_perms;
	allow dirsrvadmin_script_t self:unix_dgram_socket create_socket_perms;
	allow dirsrvadmin_script_t self:netlink_route_socket r_netlink_socket_perms;
	allow dirsrvadmin_script_t self:sem create_sem_perms;


	manage_files_pattern(dirsrvadmin_script_t, dirsrvadmin_lock_t, dirsrvadmin_lock_t)
	files_lock_filetrans(dirsrvadmin_script_t, dirsrvadmin_lock_t, { file })

	kernel_read_kernel_sysctls(dirsrvadmin_script_t)

    auth_read_passwd(dirsrvadmin_script_t)

	corenet_tcp_bind_generic_node(dirsrvadmin_script_t)
	corenet_udp_bind_generic_node(dirsrvadmin_script_t)
	corenet_all_recvfrom_netlabel(dirsrvadmin_script_t)

	corenet_tcp_bind_http_port(dirsrvadmin_script_t)
	corenet_tcp_connect_generic_port(dirsrvadmin_script_t)
	corenet_tcp_connect_ldap_port(dirsrvadmin_script_t)
	corenet_tcp_connect_http_port(dirsrvadmin_script_t)

	files_search_var_lib(dirsrvadmin_script_t)

	sysnet_read_config(dirsrvadmin_script_t)

	manage_files_pattern(dirsrvadmin_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
	manage_lnk_files_pattern(dirsrvadmin_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
	manage_dirs_pattern(dirsrvadmin_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
	files_tmp_filetrans(dirsrvadmin_script_t, dirsrvadmin_tmp_t, { file dir })
    
    miscfiles_read_certs(dirsrvadmin_script_t)

    optional_policy(`
        dirsrvadmin_systemctl(dirsrvadmin_script_t)
    ')

	optional_policy(`
		apache_read_modules(dirsrvadmin_script_t)
		apache_read_config(dirsrvadmin_script_t)
        apache_read_pid_files(dirsrvadmin_script_t)
        apache_read_tmp_symlinks(dirsrvadmin_script_t)
        apache_read_tmp_files(dirsrvadmin_script_t)
        apache_read_tmp_dirs(dirsrvadmin_script_t)
		apache_signal(dirsrvadmin_script_t)
		apache_signull(dirsrvadmin_script_t)
	')

	optional_policy(`
		# The CGI scripts must be able to manage dirsrv-admin
		dirsrvadmin_run_exec(dirsrvadmin_script_t)
		dirsrvadmin_manage_config(dirsrvadmin_script_t)
		dirsrv_domtrans(dirsrvadmin_script_t)
		dirsrv_signal(dirsrvadmin_script_t)
		dirsrv_signull(dirsrvadmin_script_t)
		dirsrv_manage_log(dirsrvadmin_script_t)
		dirsrv_manage_var_lib(dirsrvadmin_script_t)
		dirsrv_pid_filetrans(dirsrvadmin_script_t)
		dirsrv_manage_var_run(dirsrvadmin_script_t)
		dirsrv_manage_config(dirsrvadmin_script_t)
		dirsrv_read_share(dirsrvadmin_script_t)
	')
')

#######################################
#
# Local policy for the admin CGIs
#
#


manage_files_pattern(dirsrvadmin_unconfined_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
manage_dirs_pattern(dirsrvadmin_unconfined_script_t, dirsrvadmin_tmp_t, dirsrvadmin_tmp_t)
files_tmp_filetrans(dirsrvadmin_unconfined_script_t, dirsrvadmin_tmp_t, { file dir })

# needed because of filetrans rules
dirsrvadmin_run_exec(dirsrvadmin_unconfined_script_t)
dirsrvadmin_manage_config(dirsrvadmin_unconfined_script_t)
dirsrv_domtrans(dirsrvadmin_unconfined_script_t)
dirsrv_signal(dirsrvadmin_unconfined_script_t)
dirsrv_signull(dirsrvadmin_unconfined_script_t)
dirsrv_manage_log(dirsrvadmin_unconfined_script_t)
dirsrv_manage_var_lib(dirsrvadmin_unconfined_script_t)
dirsrv_pid_filetrans(dirsrvadmin_unconfined_script_t)
dirsrv_manage_var_run(dirsrvadmin_unconfined_script_t)
dirsrv_manage_config(dirsrvadmin_unconfined_script_t)
dirsrv_read_share(dirsrvadmin_unconfined_script_t)

optional_policy(`
   unconfined_domain(dirsrvadmin_unconfined_script_t)
')