# Roundup Issue Tracking System

#

# Authors:  W. Michael Petullo 

#

daemon_domain(roundup)

var_lib_domain(roundup)

can_network(roundup_t)

allow roundup_t http_cache_port_t:tcp_socket name_bind;

allow roundup_t smtp_port_t:tcp_socket name_connect;

# execute python

allow roundup_t bin_t:dir r_dir_perms;

can_exec(roundup_t, bin_t)

allow roundup_t bin_t:lnk_file read;

allow roundup_t self:capability { setgid setuid };

allow roundup_t self:unix_stream_socket create_stream_socket_perms;

ifdef(`mysqld.te', `

allow roundup_t mysqld_db_t:dir search;

allow roundup_t mysqld_var_run_t:sock_file write;

allow roundup_t mysqld_t:unix_stream_socket connectto;

')

# /usr/share/mysql/charsets/Index.xml

allow roundup_t usr_t:file { getattr read };

allow roundup_t urandom_device_t:chr_file { getattr read };

allow roundup_t etc_t:file { getattr read };