policy_module(rngd, 1.0.2)

########################################

#

# Declarations

#

type rngd_t;

type rngd_exec_t;

init_daemon_domain(rngd_t, rngd_exec_t)

type rngd_initrc_exec_t;

init_script_file(rngd_initrc_exec_t)

type rngd_unit_file_t;

systemd_unit_file(rngd_unit_file_t)

########################################

#

# Local policy

#

allow rngd_t self:capability sys_admin;

allow rngd_t self:process signal;

allow rngd_t self:fifo_file rw_fifo_file_perms;

allow rngd_t self:unix_stream_socket { accept listen };

kernel_rw_kernel_sysctl(rngd_t)

dev_read_rand(rngd_t)

dev_read_urand(rngd_t)

dev_rw_tpm(rngd_t)

dev_write_rand(rngd_t)

logging_send_syslog_msg(rngd_t)