policy_module(ut2004,1.0.2)


########################################
#
# Declarations
#


type ut2004_t;
type ut2004_exec_t;
application_domain(ut2004_t, ut2004_exec_t)
role system_r types ut2004_t;

# unused
# type ut2004_tmp_t;
# files_tmp_file(ut2004_tmp_t)

type ut2004_rw_t;
files_type(ut2004_rw_t)

type ut2004_port_t;
corenet_port(ut2004_port_t)


########################################
#
# Local policy
#

# self

allow ut2004_t self:fifo_file rw_file_perms;
allow ut2004_t self:unix_stream_socket create_stream_socket_perms;
allow ut2004_t self:tcp_socket create_stream_socket_perms;
allow ut2004_t self:udp_socket { create_socket_perms listen };

allow ut2004_t self:process execmem;
allow ut2004_t self:process signal;

allow ut2004_t self:shm { write unix_read unix_write read destroy create };


# run in our domain

optional_policy(`
	ut2004_run(guest_t, guest_r, { guest_tty_device_t guest_devpts_t })
')

optional_policy(`
	ut2004_run(staff_t, staff_r, { staff_tty_device_t staff_devpts_t })
')

optional_policy(`
	ut2004_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t })
')

optional_policy(`
	ut2004_run(unconfined_t, unconfined_r, { unconfined_tty_device_t unconfined_devpts_t })
')

optional_policy(`
	ut2004_run(user_t, user_r, { user_tty_device_t user_devpts_t })
')

optional_policy(`
	ut2004_run(xguest_t, xguest_r, { xguest_tty_device_t xguest_devpts_t })
')

# manage rw files in our domain

ut2004_manage_rw_files(ut2004_t)

# bind sockets to ports in out domain

ut2004_bind_tcp_ports(ut2004_t)
ut2004_bind_udp_ports(ut2004_t)

# connect to tcp ports in our domain

ut2004_connect_tcp_ports(ut2004_t)

# manage tmp files in our domain
# unused
# ut2004_manage_tmp_files(ut2004_t)

# write to ut2004 files on shm device

ut2004_write_shm_files(xdm_xserver_t)


# reference for other domain interfaces
#
# file:///usr/share/doc/selinux-policy-3.0.8/html/index.html


# read in other domains

files_read_etc_files(ut2004_t)
init_read_utmp(ut2004_t)
kernel_read_system_state(ut2004_t)
kernel_read_network_state(ut2004_t)
xserver_read_xdm_tmp_files(ut2004_t)
files_read_usr_files(ut2004_t)
files_read_usr_symlinks(ut2004_t)
dev_read_sound(ut2004_t)
dev_read_input(ut2004_t)
userdom_read_unpriv_users_home_content_files(ut2004_t)
xserver_read_user_iceauth(user,ut2004_t)
miscfiles_read_localization(ut2004_t)

# use in other domains

auth_use_nsswitch(ut2004_t)
libs_use_ld_so(ut2004_t)
libs_use_shared_libs(ut2004_t)

# dont audit

term_dontaudit_search_ptys(ut2004_t)
term_dontaudit_use_ptmx(ut2004_t)
init_dontaudit_write_utmp(ut2004_t)
nscd_dontaudit_search_pid(ut2004_t)
corenet_dontaudit_udp_bind_all_reserved_ports(ut2004_t)
corenet_dontaudit_udp_bind_all_ports(ut2004_t)
corenet_dontaudit_tcp_bind_all_reserved_ports(ut2004_t)
corenet_dontaudit_tcp_bind_all_ports(ut2004_t)
corenet_dontaudit_tcp_connect_all_reserved_ports(ut2004_t)
corenet_dontaudit_tcp_connect_all_ports(ut2004_t)
term_dontaudit_use_generic_ptys(ut2004_t)

# read and write in other domains

dev_rw_null(ut2004_t)
dev_rw_dri(ut2004_t)

# getattr in other domains

dev_getattr_event_dev(ut2004_t)
dev_getattr_dri_dev(ut2004_t)
files_getattr_usr_files(ut2004_t)
term_getattr_pty_fs(ut2004_t)

# search in other domains

files_search_home(ut2004_t)
files_search_tmp(ut2004_t)

# bind to any node

corenet_tcp_bind_inaddr_any_node(ut2004_t)
corenet_udp_bind_inaddr_any_node(ut2004_t)

# bind

corenet_tcp_sendrecv_all_if(ut2004_t)
corenet_tcp_sendrecv_all_nodes(ut2004_t)
corenet_tcp_sendrecv_all_ports(ut2004_t)

corenet_udp_sendrecv_all_if(ut2004_t)
corenet_udp_sendrecv_all_nodes(ut2004_t)
corenet_udp_sendrecv_all_ports(ut2004_t)
corenet_udp_bind_all_nodes(ut2004_t)

# various actions in other domains

sysnet_dns_name_resolve(ut2004_t)
logging_send_syslog_msg(ut2004_t)
xserver_create_xdm_tmp_sockets(ut2004_t)
xserver_stream_connect_xdm_xserver(ut2004_t)
fs_manage_tmpfs_files(ut2004_t)
dev_write_sound(ut2004_t)


# find existing interface
allow ut2004_t xdm_xserver_t:shm { unix_read read getattr associate };


# find existing interface
require {
	type unconfined_t;
}
dontaudit ut2004_t unconfined_t:unix_stream_socket connectto;