policy_module(gorg, 1.0.0)

type gorg_t;
type gorg_exec_t;
application_domain(gorg_t, gorg_exec_t)

type gorg_cache_t;
files_type(gorg_cache_t);

type gorg_config_t;
files_type(gorg_config_t);

###################################
#
# gorg_t local policy
#
allow gorg_t self:process signal;

# Allow gorg_t to put files in the gorg_cache_t location(s)
manage_dirs_pattern(gorg_t, gorg_cache_t, gorg_cache_t)
manage_files_pattern(gorg_t, gorg_cache_t, gorg_cache_t)

# Allow gorg_t to read configuration file(s)
allow gorg_t gorg_config_t:dir list_dir_perms;
read_files_pattern(gorg_t, gorg_config_t, gorg_config_t)

# gorg logs through /dev/log
logging_send_syslog_msg(gorg_t)

# Allow gorg to bind to port 8080 (http_cache_port_t)
sysnet_read_config(gorg_t)
sysnet_dns_name_resolve(gorg_t)
corenet_all_recvfrom_unlabeled(gorg_t)
corenet_all_recvfrom_netlabel(gorg_t)
corenet_tcp_sendrecv_generic_if(gorg_t)
corenet_tcp_sendrecv_generic_node(gorg_t)
#corenet_tcp_sendrecv_all_ports(gorg_t)
corenet_tcp_bind_generic_node(gorg_t)
corenet_tcp_bind_http_cache_port(gorg_t)
allow gorg_t self:netlink_route_socket { create_socket_perms nlmsg_read };
allow gorg_t self:tcp_socket { listen accept };

# Allow gorg read access to user home files (usually where cvs/git pull is stored)
files_search_home(gorg_t)
userdom_search_user_home_dirs(gorg_t)
userdom_user_home_content(gorg_t)
userdom_list_user_home_content(gorg_t)
userdom_read_user_home_content_symlinks(gorg_t)
userdom_read_user_home_content_files(gorg_t)

# Local policy
allow gorg_t self:fifo_file rw_fifo_file_perms;

# Read /etc files (xml/catalog, hosts.conf, ...)
files_read_etc_files(gorg_t)
miscfiles_read_localization(gorg_t)

# Gorg is ruby, so be able to execute ruby
corecmd_exec_bin(gorg_t)

# Output to screen
userdom_use_user_terminals(gorg_t)
domain_use_interactive_fds(gorg_t)