#
# Macros for Dbus
#
# Author: Colin Walters <walters@redhat.com>

# dbusd_domain(domain_prefix)
#
# Define a derived domain for the DBus daemon.

define(`dbusd_domain', `
ifelse(`system', `$1',`
daemon_domain(system_dbusd, `, userspace_objmgr, nscd_client_domain', `nosysadm')
# For backwards compatibility
typealias system_dbusd_t alias dbusd_t;
type etc_dbusd_t, file_type, sysadmfile;
',`
type $1_dbusd_t, domain, privlog, nscd_client_domain, userspace_objmgr;
role $1_r types $1_dbusd_t;
domain_auto_trans($1_t, system_dbusd_exec_t, $1_dbusd_t)
read_locale($1_dbusd_t)
allow $1_t $1_dbusd_t:process { sigkill signal };
allow $1_dbusd_t self:process { sigkill signal };
dontaudit $1_dbusd_t var_t:dir { getattr search };
')dnl end ifelse system

base_file_read_access($1_dbusd_t)
uses_shlib($1_dbusd_t)
allow $1_dbusd_t etc_t:file { getattr read };
r_dir_file($1_dbusd_t, etc_dbusd_t)
tmp_domain($1_dbusd) 
allow $1_dbusd_t self:process fork;
can_pipe_xdm($1_dbusd_t)

allow $1_dbusd_t self:unix_stream_socket create_stream_socket_perms;
allow $1_dbusd_t self:unix_dgram_socket create_socket_perms;

allow $1_dbusd_t urandom_device_t:chr_file { getattr read };
allow $1_dbusd_t self:file { getattr read write };
allow $1_dbusd_t proc_t:file read;

can_getsecurity($1_dbusd_t)
r_dir_file($1_dbusd_t, default_context_t)
allow $1_dbusd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
allow $1_dbusd_t self:netlink_selinux_socket create_socket_perms;

ifdef(`pamconsole.te', `
r_dir_file($1_dbusd_t, pam_var_console_t)
')

allow $1_dbusd_t self:dbus { send_msg acquire_svc };

')dnl end dbusd_domain definition

# dbusd_client(dbus_type, domain_prefix)
# Example: dbusd_client_domain(system, user)
#
# Define a new derived domain for connecting to dbus_type
# from domain_prefix_t. 
undefine(`dbusd_client')
define(`dbusd_client',`

ifdef(`dbusd.te',`
# Derived type used for connection
type $2_dbusd_$1_t;
type_change $2_t $1_dbusd_t:dbus $2_dbusd_$1_t;

# SE-DBus specific permissions
allow $2_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;

# For connecting to the bus
allow $2_t $1_dbusd_t:unix_stream_socket connectto;

ifelse(`system', `$1', `
allow { $2_t } { var_run_t system_dbusd_var_run_t }:dir search;
allow { $2_t } system_dbusd_var_run_t:sock_file write;
',`') dnl endif system
') dnl endif dbusd.te
')

# can_dbusd_converse(dbus_type, domain_prefix_a, domain_prefix_b)
# Example: can_dbusd_converse(system, hald, updfstab)
# Example: can_dbusd_converse(session, user, user)
define(`can_dbusd_converse',`')
ifdef(`dbusd.te',`
undefine(`can_dbusd_converse')
define(`can_dbusd_converse',`
allow $2_dbusd_$1_t $3_dbusd_$1_t:dbus { send_msg };
allow $3_dbusd_$1_t $2_dbusd_$1_t:dbus { send_msg };
') dnl endif dbusd.te
')