#
# Macros for locate domains.
#

#
# Author:  Russell Coker <russell@coker.com.au>
#

#
# locate_domain(domain_prefix)
#
# Define a derived domain for the locate program when executed
# by a user domain.
#
# The type declaration for the executable type for this program is
# provided separately in domains/program/locate.te. 
#
undefine(`locate_domain')
ifdef(`slocate.te', `
define(`locate_domain',`
# Derived domain based on the calling user domain and the program.
type $1_locate_t, domain;

allow $1_locate_t self:process signal;

allow $1_locate_t etc_t:file { getattr read };
allow $1_locate_t self:unix_stream_socket create_socket_perms;
r_dir_file($1_locate_t,locate_var_lib_t)
allow $1_locate_t var_lib_t:dir search;

# Transition from the user domain to this domain.
domain_auto_trans($1_t, locate_exec_t, $1_locate_t)

# The user role is authorized for this domain.
role $1_r types $1_locate_t;

# Inherit and use descriptors from gnome-pty-helper.
ifdef(`gnome-pty-helper.te', `
allow $1_locate_t $1_gph_t:fd use;
')

allow $1_locate_t privfd:fd use;

# allow ps to show locate
can_ps($1_t, $1_locate_t)
allow $1_t $1_locate_t:process signal;

uses_shlib($1_locate_t)
access_terminal($1_locate_t, $1)

allow $1_locate_t { home_root_t $1_home_dir_t $1_file_type }:dir { getattr search };
allow $1_locate_t $1_file_type:{ file lnk_file } { getattr read };

base_file_read_access($1_locate_t)
r_dir_file($1_locate_t, { etc_t lib_t var_t })
dontaudit $1_locate_t { fs_type file_type }:dir r_dir_perms;
dontaudit $1_locate_t { fs_type file_type -shadow_t}:file { getattr read };
')

', `

define(`locate_domain',`')

')