policy_module(zoneminder, 1.0.0)

########################################
#
# Declarations
#

## <desc>
## <p>
## Allow ZoneMinder to modify public files
## used for public file transfer services.
## </p>
## </desc>
gen_tunable(zoneminder_anon_write, false)

type zoneminder_t;
type zoneminder_exec_t;
init_daemon_domain(zoneminder_t, zoneminder_exec_t)

type zoneminder_initrc_exec_t;
init_script_file(zoneminder_initrc_exec_t)

type zoneminder_log_t;
logging_log_file(zoneminder_log_t)

type zoneminder_tmpfs_t;
files_tmpfs_file(zoneminder_tmpfs_t)

type zoneminder_spool_t;
files_type(zoneminder_spool_t)

type zoneminder_var_lib_t;
files_type(zoneminder_var_lib_t)

type zoneminder_var_run_t;
files_pid_file(zoneminder_var_run_t)

########################################
#
# zoneminder local policy
#
allow zoneminder_t self:capability { chown dac_override };
allow zoneminder_t self:process { signal_perms setpgid };
allow zoneminder_t self:shm create_shm_perms;
allow zoneminder_t self:fifo_file rw_fifo_file_perms;
allow zoneminder_t self:unix_stream_socket { create_stream_socket_perms connectto };

manage_dirs_pattern(zoneminder_t, zoneminder_log_t, zoneminder_log_t)
manage_files_pattern(zoneminder_t, zoneminder_log_t, zoneminder_log_t)
logging_log_filetrans(zoneminder_t, zoneminder_log_t, { dir file })

manage_dirs_pattern(zoneminder_t, zoneminder_tmpfs_t, zoneminder_tmpfs_t)
manage_files_pattern(zoneminder_t, zoneminder_tmpfs_t, zoneminder_tmpfs_t)
manage_lnk_files_pattern(zoneminder_t, zoneminder_tmpfs_t, zoneminder_tmpfs_t)
fs_tmpfs_filetrans(zoneminder_t, zoneminder_tmpfs_t, { dir file lnk_file })

manage_dirs_pattern(zoneminder_t, zoneminder_var_lib_t, zoneminder_var_lib_t)
manage_files_pattern(zoneminder_t, zoneminder_var_lib_t, zoneminder_var_lib_t)
manage_sock_files_pattern(zoneminder_t, zoneminder_var_lib_t, zoneminder_var_lib_t)
files_var_lib_filetrans(zoneminder_t, zoneminder_var_lib_t, { dir file sock_file })

manage_dirs_pattern(zoneminder_t, zoneminder_var_run_t, zoneminder_var_run_t)
manage_files_pattern(zoneminder_t, zoneminder_var_run_t, zoneminder_var_run_t)
files_pid_filetrans(zoneminder_t, zoneminder_var_run_t, { dir file })

manage_dirs_pattern(zoneminder_t, zoneminder_spool_t, zoneminder_spool_t)
manage_files_pattern(zoneminder_t, zoneminder_spool_t, zoneminder_spool_t)
manage_lnk_files_pattern(zoneminder_t, zoneminder_spool_t, zoneminder_spool_t)
files_spool_filetrans(zoneminder_t, zoneminder_spool_t, { dir file })

kernel_read_system_state(zoneminder_t)

corecmd_exec_bin(zoneminder_t)
corecmd_exec_shell(zoneminder_t)

corenet_tcp_bind_http_cache_port(zoneminder_t)
corenet_tcp_bind_transproxy_port(zoneminder_t)
corenet_tcp_connect_http_port(zoneminder_t)

dev_read_sysfs(zoneminder_t)
dev_read_rand(zoneminder_t)
dev_read_urand(zoneminder_t)
dev_read_video_dev(zoneminder_t)
dev_write_video_dev(zoneminder_t)


auth_use_nsswitch(zoneminder_t)

logging_send_syslog_msg(zoneminder_t)

tunable_policy(`zoneminder_anon_write',`
	miscfiles_manage_public_files(zoneminder_t)
')

optional_policy(`
	mysql_stream_connect(zoneminder_t)
')

########################################
#
# zoneminder cgi local policy
#

optional_policy(`
	apache_content_template(zoneminder)

	# need more testing
	#allow httpd_zoneminder_script_t self:shm create_shm_perms;

	manage_sock_files_pattern(httpd_zoneminder_script_t, zoneminder_var_lib_t, zoneminder_var_lib_t)
	zoneminder_stream_connect(httpd_zoneminder_script_t)
	
	files_search_var_lib(httpd_zoneminder_script_t)

	logging_send_syslog_msg(httpd_zoneminder_script_t)

	optional_policy(`
	    	mysql_stream_connect(httpd_zoneminder_script_t)
	')

')