#DESC BINDGRAPH - bind statistics graph tool
# Authors:  Erich Schubert <erich@debian.org>
# X-Debian-Packages: bindgraph
#

daemon_domain(bindgraph)
daemon_domain(bindgraph_cgi)
# lib is for the RRD files (data gathered)
type bindgraph_lib_t, file_type, sysadmfile;
# the cache is storing generated images
type bindgraph_cache_t, file_type, sysadmfile;

# maybe the same pid file removal rule is needed as for mailgraph?

# read log files
r_dir_file(bindgraph_t, var_log_t)

# write own lib files (RRD files)
allow bindgraph_t var_lib_t:dir search;
create_dir_file(bindgraph_t, bindgraph_lib_t)
# the cgi may only read the RRD files
r_dir_file(bindgraph_cgi_t, bindgraph_lib_t)

# cgi can write in cache
create_dir_file(bindgraph_cgi_t, bindgraph_cache_t)
allow bindgraph_cgi_t var_lib_t:dir search;

# perl behaviour
allow { bindgraph_t bindgraph_cgi_t } { bin_t sbin_t }:dir { search getattr };
r_dir_file({ bindgraph_t bindgraph_cgi_t }, usr_t)
allow { bindgraph_t bindgraph_cgi_t } { random_device_t urandom_device_t }:chr_file read;