# DESC resmgrd - resource manager daemon
#
# Author: Thomas Bleher <ThomasBleher@gmx.de>
 
daemon_base_domain(resmgrd)
var_run_domain(resmgrd, { file sock_file })
etc_domain(resmgrd)
read_locale(resmgrd_t)
allow resmgrd_t self:capability { dac_override dac_read_search sys_admin sys_rawio };

allow resmgrd_t etc_t:file { getattr read };
allow resmgrd_t self:unix_stream_socket create_stream_socket_perms; 
allow resmgrd_t self:unix_dgram_socket create_socket_perms;

# hardware access
allow resmgrd_t device_t:lnk_file { getattr read };
# not sure if it needs write access, needs to be investigated further...
allow resmgrd_t removable_device_t:blk_file { getattr ioctl read write };
allow resmgrd_t scsi_generic_device_t:chr_file { getattr ioctl read write };
allow resmgrd_t scanner_device_t:chr_file { getattr };
# I think a dontaudit should be enough there
dontaudit resmgrd_t fixed_disk_device_t:blk_file { getattr ioctl read };

# there is a macro can_resmgrd_connect() in macros/program/resmgrd_macros.te