policy_module(atop, 0.1.13)

########################################
#
# Declarations
#

attribute_role atop_roles;

type atop_t;
type atop_exec_t;
init_daemon_domain(atop_t, atop_exec_t)
role atop_roles types atop_t;

type atop_initrc_exec_t;
init_script_file(atop_initrc_exec_t)

type atop_var_log_t;
logging_log_file(atop_var_log_t)

type atop_var_run_t;
files_pid_file(atop_var_run_t)

type atop_var_cache_t;
files_type(atop_var_cache_t)

########################################
#
# Local policy
#

allow atop_t atop_exec_t:file execute_no_trans;
allow atop_t self:capability { setuid sys_nice sys_resource ipc_lock sys_pacct dac_override net_raw sys_ptrace };
allow atop_t self:process { setsched sigkill setrlimit setpgid signal };
allow atop_t self:sem { write read create unix_write unix_read };
allow atop_t self:udp_socket { create ioctl };
allow atop_t self:sem associate;
allow atop_t self:rawip_socket { create getopt };
allow atop_t self:fifo_file { getattr ioctl read write };

manage_dirs_pattern(atop_t, atop_var_log_t, atop_var_log_t)
append_files_pattern(atop_t, atop_var_log_t, atop_var_log_t)
create_files_pattern(atop_t, atop_var_log_t, atop_var_log_t)
setattr_files_pattern(atop_t, atop_var_log_t, atop_var_log_t)
rw_files_pattern(atop_t, atop_var_log_t, atop_var_log_t)
logging_log_filetrans(atop_t, atop_var_log_t, file)

manage_dirs_pattern(atop_t, atop_var_cache_t, atop_var_cache_t)
manage_files_pattern(atop_t, atop_var_cache_t, atop_var_cache_t)

manage_dirs_pattern(atop_t, atop_var_run_t, atop_var_run_t)
manage_files_pattern(atop_t, atop_var_run_t, atop_var_run_t)
files_pid_filetrans(atop_t, atop_var_run_t, { file dir })

corecmd_exec_bin(atop_t)

optional_policy(`
	gen_require(`
		type initrc_t;
	')
	allow atop_t initrc_t:sem { read unix_write write associate };
')

userdom_getattr_user_home_dirs(atop_t)

kernel_getattr_proc(atop_t)
kernel_search_proc(atop_t)
kernel_list_proc(atop_t)
kernel_getattr_proc_files(atop_t)
kernel_read_proc_symlinks(atop_t)
kernel_read_system_state(atop_t)
kernel_get_sysvipc_info(atop_t)
kernel_read_kernel_sysctls(atop_t)

domain_read_all_domains_state(atop_t)
corecmd_shell_entry_type(atop_t)
kernel_read_network_state(atop_t)
fs_getattr_tmpfs(atop_t)
auth_use_nsswitch(atop_t)

storage_getattr_fixed_disk_dev(atop_t)
miscfiles_read_localization(atop_t)
dev_getattr_lvm_control(atop_t)

cron_system_entry(atop_t, atop_exec_t)

init_read_utmp(atop_t)