policy_module(zoneminder, 1.0.0)

########################################

#

# Declarations

#

## <desc>

## 

## Allow ZoneMinder to modify public files

## used for public file transfer services.

## 

## </desc>

gen_tunable(zoneminder_anon_write, false)

type zoneminder_t;

type zoneminder_exec_t;

init_daemon_domain(zoneminder_t, zoneminder_exec_t)

type zoneminder_initrc_exec_t;

init_script_file(zoneminder_initrc_exec_t)

type zoneminder_log_t;

logging_log_file(zoneminder_log_t)

type zoneminder_tmpfs_t;

files_tmpfs_file(zoneminder_tmpfs_t)

type zoneminder_spool_t;

files_type(zoneminder_spool_t)

type zoneminder_var_lib_t;

files_type(zoneminder_var_lib_t)

type zoneminder_var_run_t;

files_pid_file(zoneminder_var_run_t)

########################################

#

# zoneminder local policy

#

allow zoneminder_t self:capability { chown dac_override };

allow zoneminder_t self:process { signal_perms setpgid };

allow zoneminder_t self:shm create_shm_perms;

allow zoneminder_t self:fifo_file rw_fifo_file_perms;

allow zoneminder_t self:unix_stream_socket { create_stream_socket_perms connectto };

manage_dirs_pattern(zoneminder_t, zoneminder_log_t, zoneminder_log_t)

manage_files_pattern(zoneminder_t, zoneminder_log_t, zoneminder_log_t)

logging_log_filetrans(zoneminder_t, zoneminder_log_t, { dir file })

manage_dirs_pattern(zoneminder_t, zoneminder_tmpfs_t, zoneminder_tmpfs_t)

manage_files_pattern(zoneminder_t, zoneminder_tmpfs_t, zoneminder_tmpfs_t)

manage_lnk_files_pattern(zoneminder_t, zoneminder_tmpfs_t, zoneminder_tmpfs_t)

fs_tmpfs_filetrans(zoneminder_t, zoneminder_tmpfs_t, { dir file lnk_file })

manage_dirs_pattern(zoneminder_t, zoneminder_var_lib_t, zoneminder_var_lib_t)

manage_files_pattern(zoneminder_t, zoneminder_var_lib_t, zoneminder_var_lib_t)

manage_sock_files_pattern(zoneminder_t, zoneminder_var_lib_t, zoneminder_var_lib_t)

files_var_lib_filetrans(zoneminder_t, zoneminder_var_lib_t, { dir file sock_file })

manage_dirs_pattern(zoneminder_t, zoneminder_var_run_t, zoneminder_var_run_t)

manage_files_pattern(zoneminder_t, zoneminder_var_run_t, zoneminder_var_run_t)

files_pid_filetrans(zoneminder_t, zoneminder_var_run_t, { dir file })

manage_dirs_pattern(zoneminder_t, zoneminder_spool_t, zoneminder_spool_t)

manage_files_pattern(zoneminder_t, zoneminder_spool_t, zoneminder_spool_t)

manage_lnk_files_pattern(zoneminder_t, zoneminder_spool_t, zoneminder_spool_t)

files_spool_filetrans(zoneminder_t, zoneminder_spool_t, { dir file })

kernel_read_system_state(zoneminder_t)

corecmd_exec_bin(zoneminder_t)

corecmd_exec_shell(zoneminder_t)

corenet_tcp_bind_http_cache_port(zoneminder_t)

corenet_tcp_bind_transproxy_port(zoneminder_t)

corenet_tcp_connect_http_port(zoneminder_t)

dev_read_sysfs(zoneminder_t)

dev_read_rand(zoneminder_t)

dev_read_urand(zoneminder_t)

dev_read_video_dev(zoneminder_t)

dev_write_video_dev(zoneminder_t)

auth_use_nsswitch(zoneminder_t)

logging_send_syslog_msg(zoneminder_t)

tunable_policy(`zoneminder_anon_write',`

	miscfiles_manage_public_files(zoneminder_t)

')

optional_policy(`

	mysql_stream_connect(zoneminder_t)

')

########################################

#

# zoneminder cgi local policy

#

optional_policy(`

	apache_content_template(zoneminder)

	# need more testing

	#allow httpd_zoneminder_script_t self:shm create_shm_perms;

	manage_sock_files_pattern(httpd_zoneminder_script_t, zoneminder_var_lib_t, zoneminder_var_lib_t)

	zoneminder_stream_connect(httpd_zoneminder_script_t)

	files_search_var_lib(httpd_zoneminder_script_t)

	logging_send_syslog_msg(httpd_zoneminder_script_t)

	optional_policy(`

	    	mysql_stream_connect(httpd_zoneminder_script_t)

	')

')