policy_module(keylime, 1.0.0)

########################################
#
# Declarations
#

attribute keylime_domain;

type keylime_agent_t;
keylime_use_keylime_domain(keylime_agent_t)
type keylime_agent_exec_t;
init_daemon_domain(keylime_agent_t, keylime_agent_exec_t)

type keylime_server_t;
keylime_use_keylime_domain(keylime_server_t)
type keylime_server_exec_t;
init_daemon_domain(keylime_server_t, keylime_server_exec_t)

type keylime_log_t;
logging_log_file(keylime_log_t)

type keylime_var_lib_t;
files_type(keylime_var_lib_t)

type keylime_tmp_t;
files_tmp_file(keylime_tmp_t)

########################################
#
# keylime domain policy
#

allow keylime_domain self:tcp_socket create_stream_socket_perms;

manage_dirs_pattern(keylime_domain, keylime_tmp_t, keylime_tmp_t)
manage_files_pattern(keylime_domain, keylime_tmp_t, keylime_tmp_t)
files_tmp_filetrans(keylime_domain, keylime_tmp_t, { dir file })

manage_dirs_pattern(keylime_domain, keylime_var_lib_t, keylime_var_lib_t)
manage_files_pattern(keylime_domain, keylime_var_lib_t, keylime_var_lib_t)
files_var_lib_filetrans(keylime_domain, keylime_var_lib_t, { dir file lnk_file })

corecmd_exec_bin(keylime_domain)

corenet_tcp_bind_generic_node(keylime_domain)
corenet_tcp_bind_all_ports(keylime_domain)
corenet_tcp_connect_all_unreserved_ports(keylime_domain)

dev_read_sysfs(keylime_domain)

fs_tmpfs_filetrans(keylime_domain, keylime_var_lib_t, { dir file })

init_named_socket_activation(keylime_domain, keylime_var_lib_t, "keylime")

miscfiles_read_generic_certs(keylime_domain)

sysnet_read_config(keylime_domain)

userdom_exec_user_tmp_files(keylime_domain)
userdom_manage_user_tmp_dirs(keylime_domain)
userdom_manage_user_tmp_files(keylime_domain)

########################################
#
# keylime server policy
#

allow keylime_server_t self:netlink_route_socket { create_stream_socket_perms nlmsg_read };
allow keylime_server_t self:udp_socket create_stream_socket_perms;

manage_dirs_pattern(keylime_server_t, keylime_log_t, keylime_log_t)
manage_files_pattern(keylime_server_t, keylime_log_t, keylime_log_t)

fs_rw_inherited_tmpfs_files(keylime_server_t)

optional_policy(`
        gpg_exec(keylime_server_t)
')

optional_policy(`
        kerberos_read_config(keylime_server_t)
        kerberos_read_keytab(keylime_server_t)
')

optional_policy(`
        sssd_run_stream_connect(keylime_server_t)
')


########################################
#
# keylime agent policy
#
#work with /var/lib/keylime/secure
allow keylime_agent_t self:capability { chown dac_override dac_read_search setgid setuid sys_nice sys_ptrace };
allow keylime_agent_t self:chr_file getattr;

#FIX ME, add to tabrmd policy interface related with this
allow keylime_agent_t domain:unix_stream_socket rw_stream_socket_perms; #selint-disable:W-001

dev_rw_tpm(keylime_agent_t)

exec_files_pattern(keylime_agent_t, keylime_var_lib_t, keylime_var_lib_t)
files_read_var_lib_files(keylime_agent_t)

fs_dontaudit_search_cgroup_dirs(keylime_agent_t)
fs_getattr_cgroup(keylime_agent_t)
fs_mount_tmpfs(keylime_agent_t)
fs_setattr_tmpfs_dirs(keylime_agent_t)

init_dontaudit_stream_connect(keylime_agent_t)

kernel_read_all_proc(keylime_agent_t)

userdom_dontaudit_search_user_home_dirs(keylime_agent_t)

auth_read_passwd(keylime_agent_t)

keylime_mounton_var_lib(keylime_agent_t)

mount_domtrans(keylime_agent_t)

selinux_read_policy(keylime_agent_t)

optional_policy(`
        #FIX ME, add to tabrmd policy interface related with this
        #https://github.com/tpm2-software/tpm2-abrmd/blob/master/selinux
        dbus_chat_system_bus(keylime_agent_t)
')

optional_policy(`
        dbus_stream_connect_system_dbusd(keylime_agent_t)
        dbus_system_bus_client(keylime_agent_t)
')

optional_policy(`
        systemd_userdbd_stream_connect(keylime_agent_t)
        systemd_machined_stream_connect(keylime_agent_t)
')