policy_module(matahari,1.0.0)

########################################
#
# Declarations
#

attribute matahari_domain;

matahari_domain_template(hostd)
matahari_domain_template(netd)
matahari_domain_template(rpcd)
matahari_domain_template(serviced)
matahari_domain_template(sysconfigd)

type matahari_initrc_exec_t;
init_script_file(matahari_initrc_exec_t)

type matahari_var_lib_t;
files_type(matahari_var_lib_t)

type matahari_var_run_t;
files_pid_file(matahari_var_run_t)

########################################
#
# matahari_hostd local policy
#

dev_read_sysfs(matahari_hostd_t)
dev_rw_mtrr(matahari_hostd_t)

domain_use_interactive_fds(matahari_hostd_t)
domain_read_all_domains_state(matahari_hostd_t)

optional_policy(`
	dbus_system_bus_client(matahari_hostd_t)
')

########################################
#
# matahari_netd local policy
#

domain_use_interactive_fds(matahari_netd_t)

optional_policy(`
	dbus_system_bus_client(matahari_netd_t)
')


#######################################
#
# matahari_rpcd local policy
#

corecmd_exec_bin(matahari_rpcd_t)
corecmd_exec_shell(matahari_rpcd_t)

auth_read_passwd(matahari_rpcd_t)

files_read_usr_files(matahari_rpcd_t)

########################################
#
# matahari_serviced local policy
#
allow matahari_serviced_t self:process setpgid;

dev_read_sysfs(matahari_serviced_t)

domain_use_interactive_fds(matahari_serviced_t)

init_domtrans_script(matahari_serviced_t)

systemd_config_all_services(matahari_serviced_t)

########################################
#
# matahari_sysconfigd local policy
#
dev_read_sysfs(matahari_sysconfigd_t)

#######################################
#
# matahari domain local policy
#
allow matahari_domain self:capability sys_nice;
allow matahari_domain self:process setsched;
allow matahari_domain self:process signal;
allow matahari_domain self:fifo_file rw_fifo_file_perms;
allow matahari_domain self:unix_stream_socket create_stream_socket_perms;

kernel_read_system_state(matahari_domain)
kernel_read_network_state(matahari_domain)

corenet_tcp_connect_matahari_port(matahari_domain)

dev_read_urand(matahari_domain)

files_read_etc_files(matahari_domain)
files_read_etc_runtime_files(matahari_domain)

logging_send_syslog_msg(matahari_domain)

miscfiles_read_localization(matahari_domain)

sysnet_dns_name_resolve(matahari_domain)