policy_module(afsd,1.0.0)

########################################
#
# Declarations
#

type afsd_t;
type afsd_exec_t;
domain_type(afsd_t)
init_daemon_domain(afsd_t, afsd_exec_t)

# var/lib files
type afsd_etc_t;
type afsd_cache_t;
files_type(afsd_etc_t)
files_type(afsd_cache_t)

allow afsd_t { afsd_etc_t afsd_cache_t }:dir manage_dir_perms;
allow afsd_t { afsd_etc_t afsd_cache_t }:file_class_set manage_file_perms;
#files_var_lib_filetrans(afsd_t,afsd_cache_t, { file dir sock_file })

########################################
#
# AFS local policy

files_read_etc_files(afsd_t)
files_rw_etc_runtime_files(afsd_t)
libs_use_ld_so(afsd_t)
libs_use_shared_libs(afsd_t)
miscfiles_read_localization(afsd_t)

# Init script handling
init_use_fds(afsd_t)
init_use_script_ptys(afsd_t)
domain_use_interactive_fds(afsd_t)

files_mounton_default(afsd_t)
kernel_read_system_state(afsd_t)
kernel_write_proc_files(afsd_t)
fs_mount_nfs(afsd_t)
fs_remount_nfs(afsd_t)
fs_unmount_nfs(afsd_t)
fs_manage_nfs_files(afsd_t)
fs_manage_nfs_symlinks(afsd_t)
fs_manage_nfs_named_pipes(afsd_t)
fs_manage_nfs_named_sockets(afsd_t)

fs_getattr_xattr_fs(afsd_t);

allow afsd_t self:dir mounton;
allow afsd_t self:process setsched;
allow afsd_t self:capability { sys_admin sys_nice sys_tty_config};

require {
	type afs_bos_port_t,afs_fs_port_t,afs_fs_port_t,afs_ka_port_t,afs_pt_port_t,afs_vl_port_t;
	type netif_t, node_t;
}
allow afsd_t { self afs_bos_port_t afs_fs_port_t afs_fs_port_t afs_ka_port_t afs_pt_port_t afs_vl_port_t }:tcp_socket all_tcp_socket_perms;
allow afsd_t { self afs_bos_port_t afs_fs_port_t afs_fs_port_t afs_ka_port_t afs_pt_port_t afs_vl_port_t }:udp_socket all_udp_socket_perms;
allow afsd_t netif_t:netif { udp_recv udp_send };
allow afsd_t node_t:node { udp_recv udp_send };

require {
	type crond_t, kernel_t, sshd_t, user_t;
}
afs_access(afsd_t);
afs_access(crond_t);
afs_access(kernel_t);
afs_access(sshd_t);
afs_access(user_t);

require {
	type initrc_t;
}
# init.d script sets up cell files:
allow initrc_t afsd_etc_t:file { setattr write };
# permit aklog:
allow user_t proc_t:file write;