# DESC timidity - MIDI to WAV converter and player
#
# Author: Thomas Bleher <ThomasBleher@gmx.de>
#
# Note: You only need this policy if you want to run timidity as a server

daemon_base_domain(timidity)
can_network_server(timidity_t)

allow timidity_t device_t:lnk_file read;

# read /usr/share/alsa/alsa.conf
allow timidity_t usr_t:file { getattr read };
# read /etc/esd.conf and /proc/cpuinfo
allow timidity_t { etc_t proc_t }:file { getattr read };
# read libartscbackend.la - should these be shlib_t?
allow timidity_t lib_t:file { getattr read };

allow timidity_t sound_device_t:chr_file { read write ioctl };

# stupid timidity won't start if it can't search its current directory.
# allow this so /etc/init.d/alsasound start works from /root
allow timidity_t sysadm_home_dir_t:dir search;

allow timidity_t tmp_t:dir search;
tmpfs_domain(timidity)

allow timidity_t self:shm create_shm_perms;

allow timidity_t self:unix_stream_socket create_stream_socket_perms;

allow timidity_t devpts_t:dir search;
allow timidity_t self:capability { dac_override dac_read_search };
allow timidity_t self:process getsched;