#DESC Calamaris - Squid log analysis
#
# Author:  Russell Coker <russell@coker.com.au>
# X-Debian-Packages: calamaris
# Depends: squid.te
#

#################################
#
# Rules for the calamaris_t domain.
#
# calamaris_t is the domain the calamaris process runs in

system_domain(calamaris, `, privmail')

ifdef(`crond.te', `
system_crond_entry(calamaris_exec_t, calamaris_t)
')

allow calamaris_t { var_t var_run_t }:dir { getattr search };
allow calamaris_t squid_log_t:dir search;
allow calamaris_t squid_log_t:file { getattr read };
allow calamaris_t { usr_t lib_t }:file { getattr read };
allow calamaris_t usr_t:lnk_file { getattr read };
dontaudit calamaris_t usr_t:file ioctl;

type calamaris_www_t, file_type, sysadmfile;
ifdef(`apache.te', `
allow calamaris_t httpd_sys_content_t:dir search;
')
rw_dir_create_file(calamaris_t, calamaris_www_t)

# for when squid has a different UID
allow calamaris_t self:capability dac_override;

logdir_domain(calamaris)

allow calamaris_t device_t:dir search;
allow calamaris_t devtty_t:chr_file { read write };

allow calamaris_t urandom_device_t:chr_file { getattr read };

allow calamaris_t self:process { fork signal_perms setsched };
read_sysctl(calamaris_t)
allow calamaris_t proc_t:dir search;
allow calamaris_t proc_t:file { getattr read };
allow calamaris_t { proc_t self }:lnk_file read;
allow calamaris_t self:dir search;

allow calamaris_t { bin_t sbin_t }:dir search;
allow calamaris_t bin_t:lnk_file read;
allow calamaris_t etc_runtime_t:file { getattr read };
allow calamaris_t self:fifo_file { getattr read write ioctl };
read_locale(calamaris_t)

can_exec(calamaris_t, bin_t)
allow calamaris_t self:unix_stream_socket create_stream_socket_perms;
allow calamaris_t self:udp_socket create_socket_perms;
allow calamaris_t etc_t:file { getattr read };
allow calamaris_t etc_t:lnk_file read;
dontaudit calamaris_t etc_t:file ioctl;
dontaudit calamaris_t sysadm_home_dir_t:dir { getattr search };
can_network_server(calamaris_t)
can_ypbind(calamaris_t)
ifdef(`named.te', `
can_udp_send(calamaris_t, named_t)
can_udp_send(named_t, calamaris_t)
')

ifdef(`apache.te', `
r_dir_file(httpd_t, calamaris_www_t)
')