policy_module(sympa)

########################################
#
# Declarations
#

type sympa_t;
type sympa_exec_t;
init_daemon_domain(sympa_t, sympa_exec_t)

type sympa_etc_t;
files_config_file(sympa_etc_t)

type sympa_runtime_t;
files_runtime_file(sympa_runtime_t)

type sympa_tmp_t;
files_tmp_file(sympa_tmp_t)

type sympa_var_t;
files_type(sympa_var_t)

########################################
#
# Local policy
#

allow sympa_t self:capability { chown dac_override setgid setuid };
allow sympa_t self:fifo_file rw_fifo_file_perms;
allow sympa_t self:tcp_socket create_socket_perms;
allow sympa_t self:unix_dgram_socket create_socket_perms;
allow sympa_t self:process signull;

allow sympa_t sympa_etc_t:dir list_dir_perms;
allow sympa_t sympa_etc_t:file read_file_perms;

allow sympa_t sympa_runtime_t:dir manage_dir_perms;
allow sympa_t sympa_runtime_t:file manage_file_perms;
allow sympa_t sympa_runtime_t:sock_file manage_sock_file_perms;

allow sympa_t sympa_var_t:dir manage_dir_perms;
allow sympa_t sympa_var_t:file manage_file_perms;

allow sympa_t sympa_tmp_t:file manage_file_perms;
files_tmp_filetrans(sympa_t, sympa_tmp_t, { file })

can_exec(sympa_t, sympa_exec_t)

auth_dontaudit_read_shadow(sympa_t)

# for setting SE Linux context in systemd unit file
corecmd_bin_entry_type(sympa_t)

corecmd_exec_bin(sympa_t)
corecmd_exec_shell(sympa_t)

dev_read_urand(sympa_t)

files_read_etc_files(sympa_t)
files_read_usr_files(sympa_t)
files_search_spool(sympa_t)
files_search_var_lib(sympa_t)

kernel_read_kernel_sysctls(sympa_t)

logging_send_syslog_msg(sympa_t)

miscfiles_read_generic_certs(sympa_t)
miscfiles_read_localization(sympa_t)

sysnet_read_config(sympa_t)

optional_policy(`
	apache_search_sys_scripts(sympa_t)
')

optional_policy(`
	mta_read_config(sympa_t)
	mta_send_mail(sympa_t)
	mta_rw_inherited_delivery_pipes(sympa_t)
')

optional_policy(`
	mysql_tcp_connect(sympa_t)
	mysql_stream_connect(sympa_t)
')