policy_module(tayga, 1.0.0)

########################################
#
# Declarations
#

type tayga_t;
type tayga_exec_t;
init_daemon_domain(tayga_t, tayga_exec_t)

type tayga_var_run_t;
files_pid_file(tayga_var_run_t)

type tayga_db_t;
files_type(tayga_var_db_t)

########################################
#
# tayga local policy
#

allow tayga_t self:tun_socket { create_socket_perms relabelfrom relabelto };   

manage_files_pattern(tayga_t, tayga_var_run_t, tayga_var_run_t)
files_pid_filetrans(tayga_t, tayga_var_run_t, file)

manage_dirs_pattern(tayga_t, tayga_var_db_t, tayga_var_db_t)
manage_files_pattern(tayga_t, tayga_var_db_t, tayga_var_db_t)

kernel_read_system_state(tayga_t)

corecmd_exec_shell(tayga_t)

corenet_rw_tun_tap_dev(tayga_t)

dev_read_rand(tayga_t)
dev_read_urand(tayga_t)

auth_use_nsswitch(tayga_t)

sysnet_domtrans_ifconfig(tayga_t)