## <summary>SELinux policy module</summary>
## <desc>
##	<p>
##		SELinux policy module for Irssi
##	</p>
## </desc>

#######################################
## <summary>
##      The per role template for the Irssi module.
## </summary>
## <desc>
##      <p>
##      This template creates derived domains which are used
##      for Irssi.
##      </p>
##      <p>
##      This template is invoked automatically for each user, and
##      generally does not need to be invoked directly
##      by policy writers.
##      </p>
## </desc>
## <param name="userdomain_prefix">
##      <summary>
##      The prefix of the user domain (e.g., user
##      is the prefix for user_t).
##      </summary>
## </param>
## <param name="user_domain">
##      <summary>
##      The type of the user domain.
##      </summary>
## </param>
## <param name="user_role">
##      <summary>
##      The role associated with the user domain.
##      </summary>
## </param>
#
template(`irssi_per_role_template',`
		gen_require(`
				type irssi_exec_t;
				type irssi_etc_t;
		')

		## <desc>
		## <p>
		## Confine Irssi for user groups
		## </p>
		## </desc>
		gen_tunable(irssi_confine_$1,false)

		########################################
		#
		# Declarations
		#
		type $1_irssi_t;
		application_domain($1_irssi_t,irssi_exec_t)
		role $3 types $1_irssi_t;

		type $1_irssi_home_t;
		files_poly_member($1_irssi_home_t)
		userdom_user_home_content($1,$1_irssi_home_t)

		########################################
		#
		# Local Policy
		#
		allow $1_irssi_t self:fifo_file rw_fifo_file_perms;
		allow $1_irssi_t self:process signal;
		allow $1_irssi_t self:netlink_route_socket { write getattr read bind create nlmsg_read };
		allow $1_irssi_t self:tcp_socket { write accept getattr bind listen setopt read getopt create connect };
		allow $1_irssi_t self:udp_socket { write read create connect getattr };

		allow $1_irssi_t $2:process sigchld;

		allow $2 $1_irssi_t:process { ptrace signal_perms noatsecure siginh rlimitinh };

		allow $1_irssi_t irssi_etc_t:file { getattr read };

		manage_dirs_pattern($1_irssi_t,$1_irssi_home_t,$1_irssi_home_t)
		manage_files_pattern($1_irssi_t,$1_irssi_home_t,$1_irssi_home_t)
		manage_lnk_files_pattern($1_irssi_t,$1_irssi_home_t,$1_irssi_home_t)

		userdom_user_home_dir_filetrans($1,$1_irssi_t,$1_irssi_home_t,{ dir file lnk_file })

		userdom_search_user_home_dirs($1,$1_irssi_t)

		manage_dirs_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
		manage_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
		manage_lnk_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)

		relabel_dirs_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
		relabel_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
		relabel_lnk_files_pattern($2,$1_irssi_home_t,$1_irssi_home_t)
	
		corenet_tcp_connect_ircd_port($1_irssi_t)
		corenet_sendrecv_ircd_client_packets($1_irssi_t)

		corenet_all_recvfrom_netlabel($1_irssi_t)
		corenet_all_recvfrom_unlabeled($1_irssi_t)
		corenet_tcp_sendrecv_all_if($1_irssi_t)
		corenet_tcp_sendrecv_all_nodes($1_irssi_t)
		corenet_tcp_bind_all_nodes($1_irssi_t)
		corenet_udp_bind_all_nodes($1_irssi_t)

		fs_search_auto_mountpoints($1_irssi_t)

		ps_process_pattern($2,$1_irssi_t)

		sysnet_read_config($1_irssi_t)

		libs_exec_lib_files($1_irssi_t)
		libs_use_ld_so($1_irssi_t)

		files_read_etc_files($1_irssi_t)

		files_read_usr_files($1_irssi_t)

		miscfiles_read_localization($1_irssi_t)

		nscd_read_pid($1_irssi_t)

		corecmd_dontaudit_search_bin($1_irssi_t)

		userdom_use_user_terminals($1,$1_irssi_t)

		optional_policy(`
				nis_use_ypbind($1_irssi_t)
		')

		ifdef(`enable_mls',`',`
				fs_search_removable($1_irssi_t)
				fs_read_removable_files($1_irssi_t)
				fs_read_removable_symlinks($1_irssi_t)
		')

		tunable_policy(`irssi_confine_$1',`
				domain_auto_trans($2,irssi_exec_t,$1_irssi_t)
		',`
				can_exec($2,irssi_exec_t)
		')

		# Server 4990-5000:tcp/ Client 2010:2020:tcp
		tunable_policy(`irssi_can_dcc',`
				corenet_tcp_bind_ircdcc_port($1_irssi_t)
				corenet_tcp_connect_ircdcc_port($1_irssi_t)
				corenet_tcp_sendrecv_ircdcc_port($1_irssi_t)
				corenet_sendrecv_ircdcc_client_packets($1_irssi_t)

				corenet_tcp_connect_eggdropdcc_port($1_irssi_t)
				corenet_sendrecv_eggdropdcc_client_packets($1_irssi_t)

				corenet_tcp_connect_eggdrop_port($1_irssi_t)
				corenet_sendrecv_eggdrop_client_packets($1_irssi_t)	
		')

		tunable_policy(`irssi_can_unconfined_tcp_network',`
				corenet_tcp_bind_all_unreserved_ports($1_irssi_t)
				corenet_tcp_connect_all_ports($1_irssi_t)
				corenet_tcp_sendrecv_all_ports($1_irssi_t)
				corenet_sendrecv_all_client_packets($1_irssi_t)
		')
		
		tunable_policy(`use_nfs_home_dirs',`
				fs_manage_nfs_dirs($1_irssi_t)
				fs_manage_nfs_files($1_irssi_t)
				fs_manage_nfs_symlinks($1_irssi_t)
		')

		tunable_policy(`use_samba_home_dirs',`
				fs_manage_cifs_dirs($1_irssi_t)
				fs_manage_cifs_files($1_irssi_t)
				fs_manage_cifs_symlinks($1_irssi_t)
		')
')

########################################
## <summary>
##      Read Irssi per user homedir
## </summary>
## <desc>
##      <p>
##      Read Irssi per user homedir
##      </p>
##      <p>
##      This is a templated interface, and should only
##      be called from a per-userdomain template.
##      </p>
## </desc>
## <param name="userdomain_prefix">
##      <summary>
##      The prefix of the user domain (e.g., user
##      is the prefix for user_t).
##      </summary>
## </param>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
template(`irssi_read_user_home_files',`
		gen_require(`
				type $1_irssi_home_t;
		')

		allow $2 $1_irssi_home_t:dir list_dir_perms;
		allow $2 $1_irssi_home_t:file read_file_perms;
')

########################################
## <summary>
##      Write Irssi per user homedir
## </summary>
## <desc>
##      <p>
##      Write Irssi per user homedir
##      </p>
##      <p>
##      This is a templated interface, and should only
##      be called from a per-userdomain template.
##      </p>
## </desc>
## <param name="userdomain_prefix">
##      <summary>
##      The prefix of the user domain (e.g., user
##      is the prefix for user_t).
##      </summary>
## </param>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
template(`irssi_write_user_home_files',`
		gen_require(`
				type $1_irssi_home_t;
		')

		allow $2 $1_irssi_home_t:dir list_dir_perms;
		allow $2 $1_irssi_home_t:file write;
')

########################################
## <summary>
##      Run Irssi in user Irssi domain.
## </summary>
## <desc>
##      <p>
##      Run Irssi in user Irssi domain.
##      </p>
##      <p>
##      This is a templated interface, and should only
##      be called from a per-userdomain template.
##      </p>
## </desc>
## <param name="userdomain_prefix">
##      <summary>
##      The prefix of the user domain (e.g., user
##      is the prefix for user_t).
##      </summary>
## </param>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
template(`irssi_domtrans_user_irssi',`
		gen_require(`
				type $1_irssi_t,irssi_exec_t;
		')

		domtrans_pattern($2,irssi_exec_t,$1_irssi_t)
')

########################################
## <summary>
##      Read/write Irssi per user tcp_socket
## </summary>
## <desc>
##      <p>
##      Read/write Irssi per user tcp_socket
##      </p>
##      <p>
##      This is a templated interface, and should only
##      be called from a per-userdomain template.
##      </p>
## </desc>
## <param name="userdomain_prefix">
##      <summary>
##      The prefix of the user domain (e.g., user
##      is the prefix for user_t).
##      </summary>
## </param>
## <param name="domain">
##      <summary>
##      Domain allowed access.
##      </summary>
## </param>
#
template(`irssi_rw_user_tcp_sockets',`
		gen_require(`
				type $1_irssi_t;
		')

		allow $2 $1_irssi_t:tcp_socket rw_socket_perms;
')

policy_module(irssi,1.0.0) 

########################################
#
# Declarations
#

## <desc>
## <p>
## Allow Irssi unconfined TCP networking
## </p>
## </desc>
gen_tunable(irssi_can_unconfined_tcp_network,false)

## <desc>
## <p>
## Allow Irssi to bind and connect to IRC DCC tcp network port range 4990 to 5000
## </p>
## </desc>
gen_tunable(irssi_can_dcc,false)

type irssi_exec_t;
application_executable_file(irssi_exec_t)

type irssi_etc_t;
files_config_file(irssi_etc_t)

/usr/bin/irssi                  --      gen_context(system_u:object_r:irssi_exec_t,s0)

HOME_DIR/\.irssi(/.*)?         gen_context(system_u:object_r:ROLE_irssi_home_t,s0)

/etc/irssi.conf					--		gen_context(system_u:object_r:irssi_etc_t,s0)