policy_module(memlockd, 1.0.1)

########################################
#
# Declarations
#

type memlockd_t;
type memlockd_exec_t;
init_daemon_domain(memlockd_t, memlockd_exec_t)

########################################
#
# Local policy
#

allow memlockd_t self:capability { setgid setuid ipc_lock };
allow memlockd_t self:fifo_file rw_inherited_fifo_file_perms;

# cache /etc/shadow too
auth_read_shadow(memlockd_t)
auth_map_shadow(memlockd_t)

corecmd_exec_all_executables(memlockd_t)
corecmd_exec_bin(memlockd_t)
corecmd_exec_shell(memlockd_t)
corecmd_read_all_executables(memlockd_t)
corecmd_search_bin(memlockd_t)

files_read_etc_files(memlockd_t)
files_map_etc_files(memlockd_t)

libs_exec_ld_so(memlockd_t)

logging_send_syslog_msg(memlockd_t)

miscfiles_read_localization(memlockd_t)

sysnet_mmap_read_config(memlockd_t)

ifndef(`distro_debian', `
	allow memlockd_t self:capability dac_read_search;
')