#DESC vpnc
#
# Author:  Dan Walsh <dwalsh@redhat.com>
#

#################################
#
# Rules for the vpnc_t domain, et al.
#
# vpnc_t is the domain for the vpnc program.
# vpnc_exec_t is the type of the vpnc executable.
#
application_domain(vpnc, `, sysctl_net_writer, nscd_client_domain')

allow vpnc_t { random_device_t urandom_device_t }:chr_file { getattr read };

# Use the network.
can_network(vpnc_t)
allow vpnc_t port_type:tcp_socket name_connect;
allow vpnc_t isakmp_port_t:udp_socket name_bind;

can_ypbind(vpnc_t)
allow vpnc_t self:socket create_socket_perms;

# Use capabilities.
allow vpnc_t self:capability { net_admin ipc_lock net_bind_service net_raw };

allow vpnc_t devpts_t:dir search;
allow vpnc_t etc_t:file { getattr read };
allow vpnc_t tun_tap_device_t:chr_file { ioctl read write };
allow vpnc_t self:rawip_socket create_socket_perms;
allow vpnc_t self:unix_dgram_socket create_socket_perms;
allow vpnc_t self:unix_stream_socket create_socket_perms;
allow vpnc_t { devtty_t user_tty_type admin_tty_type }:chr_file rw_file_perms;
allow vpnc_t port_t:udp_socket name_bind;
allow vpnc_t etc_runtime_t:file { getattr read };
allow vpnc_t proc_t:file { getattr read };
dontaudit vpnc_t selinux_config_t:dir search;
can_exec(vpnc_t, {bin_t sbin_t ifconfig_exec_t shell_exec_t })
allow vpnc_t sysctl_net_t:dir search;
allow vpnc_t sysctl_net_t:file write;
allow vpnc_t sbin_t:dir search;
allow vpnc_t bin_t:dir search;
allow vpnc_t bin_t:lnk_file read;
allow vpnc_t self:dir search;
r_dir_file(vpnc_t, proc_t)
r_dir_file(vpnc_t, proc_net_t)
tmp_domain(vpnc)
allow vpnc_t self:fifo_file { getattr ioctl read write };
allow vpnc_t self:file { getattr read };
allow vpnc_t self:netlink_route_socket rw_netlink_socket_perms;
file_type_auto_trans(vpnc_t, etc_t, net_conf_t, file)
allow vpnc_t etc_t:file { execute execute_no_trans ioctl };
dontaudit vpnc_t home_root_t:dir search;
dontaudit vpnc_t user_home_dir_type:dir search;
var_run_domain(vpnc)
allow vpnc_t userdomain:fd use;
r_dir_file(vpnc_t, sysfs_t)
allow vpnc_t self:process { fork sigchld };
read_locale(vpnc_t)
read_sysctl(vpnc_t)
allow vpnc_t fs_t:filesystem getattr;