module pydspam 1.0;

require {
	type default_t;
	type logrotate_t;
	type httpd_log_t;
	type var_log_t;
	type httpd_sys_script_t;
	type httpd_t;
	type httpd_dspam_rw_content_t;
	type dspam_var_lib_t;
	class capability { setuid setgid dac_override };
	class dir { read write add_name search remove_name };
	class file { create read open getattr write rename unlink setattr append };
}

#============= httpd_t ==============
#
# Allow httpd to serve banned_domains and banned_ips via symlinks to logfiles
#
allow httpd_t var_log_t:file read;

#============= httpd_sys_script_t ==============
#
# Allow pydspam.cgi to be invoked vi suexec, and manipulate /var/lib/dspam
#
allow httpd_sys_script_t dspam_var_lib_t:dir { search };
allow httpd_sys_script_t httpd_dspam_rw_content_t:dir { search write remove_name add_name };
allow httpd_sys_script_t dspam_var_lib_t:file { read open getattr };
allow httpd_sys_script_t httpd_dspam_rw_content_t:file { read open getattr write rename create unlink setattr append };
allow httpd_sys_script_t httpd_log_t:dir { write add_name };
allow httpd_sys_script_t httpd_log_t:file create;
allow httpd_sys_script_t self:capability setuid;
allow httpd_sys_script_t self:capability { setgid dac_override };

#============= logrotate_t ==============
#
# Allow logrotate to rotate files in /var/lib/dspam
#
allow logrotate_t default_t:dir read;
allow logrotate_t dspam_var_lib_t:dir { read write remove_name add_name };
allow logrotate_t dspam_var_lib_t:file { open read write getattr rename unlink create setattr };
