policy_module(yam,1.0.0)

########################################

#

# Declarations

#

type yam_t alias yam_crond_t;

type yam_exec_t;

domain_type(yam_t)

domain_entry_file(yam_t,yam_exec_t)

type yam_content_t;

files_mountpoint(yam_content_t)

type yam_etc_t;

files_config_file(yam_etc_t)

type yam_tmp_t;

files_tmp_file(yam_tmp_t)

########################################

#

# Local policy

#

allow yam_t self:capability { chown fowner fsetid dac_override };

allow yam_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };

allow yam_t self:process execmem;

allow yam_t self:fd use;

allow yam_t self:fifo_file rw_file_perms;

allow yam_t self:unix_stream_socket { create_stream_socket_perms connectto };

allow yam_t self:unix_dgram_socket { create_socket_perms sendto };

allow yam_t self:shm create_shm_perms;

allow yam_t self:sem create_sem_perms;

allow yam_t self:msgq create_msgq_perms;

allow yam_t self:msg { send receive };

allow yam_t self:tcp_socket create_socket_perms;

allow yam_t self:udp_socket create_socket_perms;

# Update the content being managed by yam.

allow yam_t yam_content_t:dir create_dir_perms;

allow yam_t yam_content_t:file create_file_perms;

allow yam_t yam_content_t:lnk_file create_lnk_perms;

allow yam_t yam_etc_t:file { getattr read };

files_search_etc(yam_t)

allow yam_t yam_tmp_t:dir create_dir_perms;

allow yam_t yam_tmp_t:file create_file_perms;

files_tmp_filetrans(yam_t, yam_tmp_t, { file dir })

kernel_read_kernel_sysctls(yam_t)

kernel_read_proc_symlinks(yam_t)

# Python works fine without reading /proc/meminfo

kernel_dontaudit_read_system_state(yam_t)

corecmd_exec_shell(yam_t)

corecmd_exec_bin(yam_t)

# Rsync and lftp need to network.  They also set files attributes to

# match whats on the remote server.

corenet_tcp_sendrecv_generic_if(yam_t)

corenet_udp_sendrecv_generic_if(yam_t)

corenet_raw_sendrecv_generic_if(yam_t)

corenet_tcp_sendrecv_all_nodes(yam_t)

corenet_udp_sendrecv_all_nodes(yam_t)

corenet_raw_sendrecv_all_nodes(yam_t)

corenet_tcp_sendrecv_all_ports(yam_t)

corenet_udp_sendrecv_all_ports(yam_t)

corenet_non_ipsec_sendrecv(yam_t)

corenet_tcp_bind_all_nodes(yam_t)

corenet_udp_bind_all_nodes(yam_t)

corenet_tcp_connect_http_port(yam_t)

corenet_tcp_connect_rsync_port(yam_t)

# mktemp

dev_read_urand(yam_t)

files_read_etc_files(yam_t)

files_read_etc_runtime_files(yam_t)

# /usr/share/createrepo/genpkgmetadata.py:

files_exec_usr_files(yam_t)

# Programs invoked to build package lists need various permissions.

# genpkglist creates tmp files in /var/cache/apt/genpkglist

files_rw_var_files(yam_t)

fs_search_auto_mountpoints(yam_t)

# Content can also be on ISO image files.

fs_read_iso9660_files(yam_t)

term_search_ptys(yam_t)

libs_use_ld_so(yam_t)

libs_use_shared_libs(yam_t)

logging_send_syslog_msg(yam_t)

miscfiles_read_localization(yam_t)

seutil_read_config(yam_t)

sysnet_read_config(yam_t)

userdom_use_unpriv_users_fds(yam_t)

# Reading dotfiles...

# cjp: ?

userdom_search_all_users_home_dirs(yam_t)

# The whole point of this program is to make updates available on a

# local web server.  Need to go through /var to get to /var/yam

# Go through /var/www to get to /var/www/yam

apache_search_sys_content(yam_t)

optional_policy(`

	cron_system_entry(yam_t,yam_exec_t)

')

optional_policy(`

	mount_domtrans(yam_t)

')

optional_policy(`

	nis_use_ypbind(yam_t)

')

optional_policy(`

	nscd_socket_use(yam_t)

')

optional_policy(`

	rsync_exec(yam_t)

')