module pvpgn 1.0.0;

require {
	class fd use;
	class process { fork signal_perms transition noatsecure siginh rlimitinh };
	class fifo_file { read write getattr lock ioctl append };
	class filesystem { getattr };
	class dir { manage_dir_perms relabelfrom };
	class file { manage_file_perms execute execute_no_trans entrypoint execmod };
	class chr_file { manage_file_perms };
	class lnk_file { read getattr lock ioctl };
	class unix_stream_socket { create_stream_socket_perms connectto };
	class sock_file { rw_file_perms };
	class netif { packet_perms };
	attribute port_type;
	class tcp_socket { create_stream_socket_perms recv_msg send_msg node_bind name_bind name_connect recvfrom };
	class udp_socket { create_stream_socket_perms recv_msg send_msg node_bind name_bind recvfrom };
	class node { packet_perms };
	class rawip_socket { recvfrom };
	class association { sendto recvfrom };
	class packet { send recv };
	class capability { setgid setuid };
}

type pvpgn_t;
type pvpgn_exec_t;
domain_type(pvpgn_t)
init_daemon_domain(pvpgn_t, pvpgn_exec_t)

type pvpgn_etc_t;
files_type(pvpgn_etc_t)

type pvpgn_var_run_t;
files_type(pvpgn_var_run_t)
files_pid_file(pvpgn_var_run_t)
files_pid_filetrans(pvpgn_t,pvpgn_var_run_t,file)

type pvpgn_var_lib_t;
files_type(pvpgn_var_lib_t)
manage_dirs_pattern(pvpgn_t, pvpgn_var_lib_t, pvpgn_var_lib_t)
manage_files_pattern(pvpgn_t, pvpgn_var_lib_t, pvpgn_var_lib_t)
files_var_lib_filetrans(pvpgn_t,pvpgn_var_lib_t,file)

type pvpgn_log_t;
files_type(pvpgn_log_t)
logging_log_filetrans(pvpgn_t, pvpgn_log_t, { file dir })

# Database connections
mysql_stream_connect(pvpgn_t)
postgresql_stream_connect(pvpgn_t)

# 
allow pvpgn_t self:capability { setgid setuid };
allow pvpgn_t self:process { fork signal_perms };

# Network
corenet_tcp_sendrecv_generic_if(pvpgn_t)
corenet_udp_sendrecv_generic_if(pvpgn_t)
corenet_udp_bind_generic_port(pvpgn_t)
corenet_tcp_bind_generic_port(pvpgn_t)
corenet_tcp_sendrecv_all_nodes(pvpgn_t)
corenet_udp_sendrecv_all_nodes(pvpgn_t)
corenet_all_recvfrom_unlabeled(pvpgn_t)
corenet_all_recvfrom_netlabel(pvpgn_t)
