########################################
## <summary>
##	Execute a domain transition to run ut2004.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
#
interface(`ut2004_domtrans',`
	gen_require(`
		type ut2004_t;
                type ut2004_exec_t;
	')

	domtrans_pattern($1,ut2004_exec_t,ut2004_t)
')


########################################
## unused
## <summary>
##	Do not audit attempts to read, 
##	ut2004 tmp files
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
# interface(`ut2004_dontaudit_read_tmp_files',`
#	gen_require(`
#		type ut2004_tmp_t;
#	')
#
#	dontaudit $1 ut2004_tmp_t:file r_file_perms;
# ')

########################################
## <summary>
##	Allow domain to read, ut2004 tmp files
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`ut2004_read_tmp_files',`
	gen_require(`
		type ut2004_tmp_t;
	')

	allow $1 ut2004_tmp_t:file r_file_perms;
')

########################################
## unused
## <summary>
##	Allow domain to manage ut2004 tmp files
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
# interface(`ut2004_manage_tmp',`
#	gen_require(`
#		type ut2004_tmp_t;
#	')
#
#         manage_dir_perms($1,ut2004_tmp_t,ut2004_tmp_t)
#         manage_file_perms($1,ut2004_tmp_t,ut2004_tmp_t)
#         manage_lnk_file_perms($1,ut2004_tmp_t,ut2004_tmp_t)
# ')

########################################
## <summary>
##	Search ut2004 rw directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`ut2004_search_rw_dir',`
	gen_require(`
		type ut2004_rw_t;
	')

	allow $1 ut2004_rw_t:dir search_dir_perms;
	files_search_rw($1)
')

########################################
## <summary>
##	Read ut2004 rw files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`ut2004_read_rw_files',`
	gen_require(`
		type ut2004_rw_t;
	')

	allow $1 ut2004_rw_t:file r_file_perms;
	allow $1 ut2004_rw_t:dir list_dir_perms;
	files_search_rw($1)
')

########################################
## <summary>
##	Create, read, write, and delete
##	ut2004 rw files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`ut2004_manage_rw_files',`
	gen_require(`
		type ut2004_rw_t;
	')

	allow $1 ut2004_rw_t:file manage_file_perms;
	allow $1 ut2004_rw_t:dir rw_dir_perms;
')

########################################
## <summary>
##	Manage ut2004 rw files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`ut2004_manage_rw',`
	gen_require(`
		type ut2004_rw_t;
	')

         manage_dir_perms($1,ut2004_rw_t,ut2004_rw_t)
         manage_file_perms($1,ut2004_rw_t,ut2004_rw_t)
         manage_lnk_file_perms($1,ut2004_rw_t,ut2004_rw_t)
')


########################################
## <summary>
##	Execute ut2004 in the ut2004 domain, and
##	allow the specified role the ut2004 domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	The role to be allowed the ut2004 domain.
##	</summary>
## </param>
## <param name="terminal">
##	<summary>
##	The type of the role's terminal.
##	</summary>
## </param>
#
interface(`ut2004_run',`
	gen_require(`
		type xguest_t;
		type xguest_devpts_t;
		type xguest_tty_device_t;
		role xguest_r;
		type user_t;
		type user_devpts_t;
		type user_tty_device_t;
		role user_r;		
		type unconfined_t;
		type unconfined_devpts_t;
		type unconfined_tty_device_t;
		role unconfined_r;
		type sysadm_t;
		type sysadm_devpts_t;
		type sysadm_tty_device_t;
		role sysadm_r;
		type staff_t;
		type staff_devpts_t;
		type staff_tty_device_t;
		role staff_r;
		type guest_t;
		type guest_devpts_t;
		type guest_tty_device_t;
		role guest_r;
		type ut2004_t;
	')

	ut2004_domtrans($1)
	role $2 types ut2004_t;
	dontaudit ut2004_t $3:chr_file rw_term_perms;
')


########################################
## <summary>
##	All of the rules required to administrate an ut2004 environment
## </summary>
## <param name="prefix">
##	<summary>
##	Prefix of the domain. Example, user would be
##	the prefix for the user_t domain.
##	</summary>
## </param>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	The role to be allowed to manage the ut2004 domain.
##	</summary>
## </param>
## <rolecap/>
#
interface(`ut2004_admin',`
	gen_require(`
		type ut2004_t;
	')

	allow $2 ut2004_t:process { ptrace signal_perms getattr };
	read_files_pattern($2, ut2004_t, ut2004_t)
	        

	ut2004_manage_tmp($2)

	ut2004_manage_rw($2)

')

########################################
## <summary>
##	Bind sockets to ut2004 tcp ports
##	
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`ut2004_bind_tcp_ports',`
	gen_require(`
		type ut2004_port_t;
	')

	allow $1 ut2004_port_t:tcp_socket name_bind;
')

########################################
## <summary>
##	Connect to ut2004 tcp ports
##	
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`ut2004_connect_tcp_ports',`
	gen_require(`
		type ut2004_port_t;
	')

	allow $1 ut2004_port_t:tcp_socket name_connect;
')

########################################
## <summary>
##	Bind sockets to ut2004 udp ports
##
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`ut2004_bind_udp_ports',`
	gen_require(`
		type ut2004_port_t;
	')

	allow $1 ut2004_port_t:udp_socket name_bind;
')

########################################
## unused
## <summary>
##	Manage ut2004 tmp permissions.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
# interface(`ut2004_manage_tmp_files',`
#	gen_require(`
#		type ut2004_tmp_t;
#	')
#	
#	allow $1 ut2004_tmp_t:file manage_file_perms;
#	allow $1 ut2004_tmp_t:dir create_dir_perms;
#	files_tmp_filetrans($1,ut2004_tmp_t, { file dir })
# ')

########################################
## <summary>
##	Write to ut2004 files on shm device.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`ut2004_write_shm_files',`
	gen_require(`
		type ut2004_t;
	')

	allow $1 ut2004_t:shm { write unix_read getattr unix_write associate read };
')