## <summary>Small and secure DNS daemon.</summary>

#######################################
## <summary>
##	The template to define a djbdns domain.
## </summary>
## <param name="domain_prefix">
##	<summary>
##	Domain prefix to be used.
##	</summary>
## </param>
#
template(`djbdns_daemontools_domain_template',`
	gen_require(`
		attribute djbdns_domain;
	')

	########################################
	#
	# Declarations
	#

	type djbdns_$1_t, djbdns_domain;
	type djbdns_$1_exec_t;
	domain_type(djbdns_$1_t)
	domain_entry_file(djbdns_$1_t, djbdns_$1_exec_t)
	role system_r types djbdns_$1_t;

	type djbdns_$1_conf_t;
	files_config_file(djbdns_$1_conf_t)

	########################################
	#
	# Local policy
	#

	daemontools_service_domain(djbdns_$1_t, djbdns_$1_exec_t)
	daemontools_read_svc(djbdns_$1_t)

	allow djbdns_$1_t djbdns_$1_conf_t:dir list_dir_perms;
	allow djbdns_$1_t djbdns_$1_conf_t:file read_file_perms;

	corenet_all_recvfrom_netlabel(djbdns_$1_t)
	corenet_tcp_sendrecv_generic_if(djbdns_$1_t)
	corenet_udp_sendrecv_generic_if(djbdns_$1_t)
	corenet_tcp_sendrecv_generic_node(djbdns_$1_t)
	corenet_udp_sendrecv_generic_node(djbdns_$1_t)
	corenet_tcp_sendrecv_all_ports(djbdns_$1_t)
	corenet_udp_sendrecv_all_ports(djbdns_$1_t)
	corenet_tcp_bind_generic_node(djbdns_$1_t)
	corenet_udp_bind_generic_node(djbdns_$1_t)
	corenet_tcp_bind_dns_port(djbdns_$1_t)
	corenet_udp_bind_dns_port(djbdns_$1_t)
	corenet_udp_bind_generic_port(djbdns_$1_t)
	corenet_sendrecv_dns_server_packets(djbdns_$1_t)
	corenet_sendrecv_generic_server_packets(djbdns_$1_t)

	files_search_var(djbdns_$1_t)
')

#####################################
## <summary>
##	Search djbdns-tinydns key ring.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`djbdns_search_tinydns_keys',`
	gen_require(`
		type djbdns_tinydns_t;
	')

	allow $1 djbdns_tinydns_t:key search;
')

#####################################
## <summary>
##	Link djbdns-tinydns key ring.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`djbdns_link_tinydns_keys',`
	gen_require(`
		type djbdns_tinydn_t;
	')

	allow $1 djbdns_tinydn_t:key link;
')