# Additional SELinux policy module for PCP QA ... this is for the
# apps in the QA suite and/or additional apps or libraries (outside
# PCP) that we use in exercising the PMDAs.
#
# This file is using the same form and same generation rule mechanisms
# as pcpupstream.te ...
#
# Most of the hints in src/selinux/README apply here.
#

module pcpqa 1.0;

require {
	type user_home_t;
	type hostname_exec_t;
	type pcp_pmcd_t;
	type usr_t;
	type user_tmp_t;

	@PCP_INITRC_TMP_T@
	@PCP_SUDO_EXEC_T@
	@PCP_SECURITY_T@
	@PCP_CHKPWD_EXEC_T@
	@PCP_INITRC_T@
	@PCP_VAR_LOG_T@
	@PCP_LASTLOG_T@
	@PCP_XAUTH_EXEC_T@
	@PCP_LOGROTATE_T@
	@PCP_FAILLOG_T@

	class file { @PCP_MAP_OP@ write };
	class process { execstack signull };
	class capability audit_write;
	class file { create execute execute_no_trans unlink write };

	@PCP_NETLINK_SELINUX_SOCKET_CLASS@
	@PCP_NETLINK_AUDIT_SOCKET_CLASS@
	@PCP_SOCK_FILE_CLASS@
	@PCP_SECURITY_CLASS@
	@PCP_DIR_CLASS@
	@PCP_RAWIP_SOCKET_CLASS@
}

#============= pcp_pmcd_t ==============

#type=AVC msg=audit(qa/255): avc:  denied  { map } for  pid=10604 comm="broken_pmda_2_0" path="/home/kenj/src/pcp/qa/pmdas/broken/broken_pmda_2_0" dev="dm-0" ino=295211 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0
#type=AVC msg=audit(qa/457): avc:  denied  { write } for  pid=31411 comm="457.pipe" name="457.pipe.pid" dev="dm-0" ino=295231 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0
allow pcp_pmcd_t user_home_t:file { @PCP_MAP_OP@ write };

#type=AVC msg=audit(qa/597): avc:  denied  { map } for  pid=27238 comm="hostname" path="/usr/bin/hostname" dev="dm-0" ino=4735 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file permissive=0
@PCP_MAP_RULE@

# type=AVC msg=audit(qa/789) avc:  denied  { add_name } for  pid=1 comm="java" name="???" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { add_name } for  pid=1 comm="sh" name="???" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:usr_t:s0 tclass=dir permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { audit_write } for  pid=1 comm="su" capability=29  scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { audit_write } for  pid=1 comm="sudo" capability=29  scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { bind } for  pid=1 comm="su" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_selinux_socket permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { compute_av } for  pid=1 comm="su" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=security permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { create } for  pid=1 comm="java" name="???" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { create } for  pid=1 comm="sh" name="???" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { create } for  pid=1 comm="sudo" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_audit_socket permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { create } for  pid=1 comm="su" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_audit_socket permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { create } for  pid=1 comm="su" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_selinux_socket permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { execstack } for  pid=1 comm="mysqladmin" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=process permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { execstack } for  pid=1 comm="zmcontrol" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=process permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { execute } for  pid=1 comm="sudo" name="???" dev="dm-0" ino=184658 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:chkpwd_exec_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { execute } for  pid=1 comm="su" name="???" dev="dm-0" ino=27112925 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:xauth_exec_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { execute } for  pid=1 comm="zmmailboxdctl" name="???" dev="dm-0" ino=26108789 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:sudo_exec_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { execute_no_trans } for  pid=1 comm="sudo" path="/usr/sbin/unix_chkpwd" dev="dm-0" ino=184658 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:chkpwd_exec_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { execute_no_trans } for  pid=1 comm="zmmailboxdctl" path="/usr/bin/sudo" dev="dm-0" ino=26108789 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:sudo_exec_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { nlmsg_relay } for  pid=1 comm="sudo" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_audit_socket permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { nlmsg_relay } for  pid=1 comm="su" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_audit_socket permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { remove_name } for  pid=1 comm="java" name="???" dev="dm-0" ino=17244315 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { remove_name } for  pid=1 comm="java" name="???" dev="dm-0" ino=17244318 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { remove_name } for  pid=1 comm="zmcontrol" name="???" dev="dm-0" ino=84011089 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:usr_t:s0 tclass=dir permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { remove_name } for  pid=1 comm="zmcontrol" name="???" dev="dm-0" ino=84011091 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:usr_t:s0 tclass=dir permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { signull } for  pid=1 comm="java" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=process permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { signull } for  pid=1 comm="ldap" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=process permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { signull } for  pid=1 comm="zmmailboxdmgr" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=process permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { unlink } for  pid=1 comm="java" name="???" dev="dm-0" ino=16958731 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { unlink } for  pid=1 comm="java" name="???" dev="dm-0" ino=17244315 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { unlink } for  pid=1 comm="zmcontrol" name="???" dev="dm-0" ino=84011089 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { unlink } for  pid=1 comm="zmcontrol" name="???" dev="dm-0" ino=84011091 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { write } for  pid=1 comm="java" name="???" dev="dm-0" ino=16823010 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { write } for  pid=1 comm="mysqladmin" name="???" dev="dm-0" ino=67726017 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=sock_file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { write } for  pid=1 comm="sh" name="???" dev="dm-0" ino=83910251 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:usr_t:s0 tclass=dir permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { write } for  pid=1 comm="sh" name="???" dev="dm-0" ino=84011093 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { write } for  pid=1 comm="sh" path="/opt/zimbra/data/tmp/zmcontrol.status.61LsA" dev="dm-0" ino=84011089 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { write } for  pid=1 comm="sh" path="/opt/zimbra/data/tmp/zmcontrol.status.tS7mV" dev="dm-0" ino=84011089 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { write } for  pid=1 comm="su" name="???" dev="dm-0" ino=25509651 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:lastlog_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { write } for  pid=1 comm="zmcontrol" name="???" dev="dm-0" ino=50378719 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=file permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { signull } for  pid=1 comm="java" scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=process permissive=1
# type=AVC msg=audit(qa/789) avc:  denied  { signull } for  pid=1 comm="java" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tclass=process permissive=1
# type=AVC msg=audit(qa/1160) avc:  denied  { create } for  pid=1 comm="ping" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=rawip_socket permissive=1
# type=AVC msg=audit(qa/1160) avc:  denied  { getopt } for  pid=1 comm="ping" lport=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=rawip_socket permissive=1
# type=AVC msg=audit(qa/1160) avc:  denied  { setopt } for  pid=1 comm="ping" lport=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=rawip_socket permissive=1
#

allow pcp_pmcd_t self:capability audit_write;
allow pcp_pmcd_t self:process execstack;
allow pcp_pmcd_t usr_t:file { create unlink write };

@PCP_INITRC_TMP_RULE_1@
@PCP_INITRC_TMP_RULE_2@
@PCP_SUDO_EXEC_RULE@
@PCP_SECURITY_RULE@
@PCP_CHKPWD_EXEC_RULE@
@PCP_INITRC_RULE@
@PCP_VAR_LOG_RULE@
@PCP_LASTLOG_RULE@
@PCP_XAUTH_EXEC_RULE@
@PCP_LOGROTATE_RULE_1@
@PCP_LOGROTATE_RULE_2@
@PCP_NETLINK_AUDIT_SOCKET_RULE@
@PCP_NETLINK_SELINUX_SOCKET_RULE@
@PCP_SOCK_FILE_RULE@
@PCP_DIR_RULE@
@PCP_RAWIP_SOCKET_RULE@

# type=AVC msg=audit(qa/789): avc:  denied  { write } for  pid=21132 comm="su" name="btmp" dev="dm-0" ino=25693341 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:faillog_t:s0 tclass=file permissive=0
@PCP_FAILLOG_RULE@

# type=AVC msg=audit(qa/805): avc:  denied  { execute execute_no_trans } for  pid=73096 comm="perl" name="805-72044.qshape" dev="dm-0" ino=8538808 scontext=unconfined_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=0
allow pcp_pmcd_t user_tmp_t:file { execute execute_no_trans };
