# DESC resmgrd - resource manager daemon

#

# Author: Thomas Bleher <ThomasBleher@gmx.de>

daemon_base_domain(resmgrd)

var_run_domain(resmgrd, { file sock_file })

etc_domain(resmgrd)

read_locale(resmgrd_t)

allow resmgrd_t self:capability { dac_override dac_read_search sys_admin sys_rawio };

allow resmgrd_t etc_t:file { getattr read };

allow resmgrd_t self:unix_stream_socket create_stream_socket_perms; 

allow resmgrd_t self:unix_dgram_socket create_socket_perms;

# hardware access

allow resmgrd_t device_t:lnk_file { getattr read };

# not sure if it needs write access, needs to be investigated further...

allow resmgrd_t removable_device_t:blk_file { getattr ioctl read write };

allow resmgrd_t scsi_generic_device_t:chr_file { getattr ioctl read write };

allow resmgrd_t scanner_device_t:chr_file { getattr };

# I think a dontaudit should be enough there

dontaudit resmgrd_t fixed_disk_device_t:blk_file { getattr ioctl read };

# there is a macro can_resmgrd_connect() in macros/program/resmgrd_macros.te