## <summary>Appgroup module</summary>

# This interface should be called from all domains that will be
# allowed to execute appgroup_exec_t file WITH domain transition,
# i.e. in the appgroup_t domain.
# Example: appgroup_autotrans(confined_t)
interface(`appgroup_autotrans',`
	gen_require(`
		type appgroup_t;
		type appgroup_exec_t;
	')
	domtrans_pattern($1, appgroup_exec_t, appgroup_t)
')

# This interface should be called from all domains that will be
# allowed to execute appgroup_exec_t file WITHOUT domain transition,
# i.e. in the caller domain.
# Example: appgroup_exec(confined_t)
interface(`appgroup_exec',`
	gen_require(`
		type appgroup_exec_t;
	')
	can_exec($1, appgroup_exec_t)
')

# This interface should be called from all domains that will be
# allowed to transition to appgroup_t domain, by executing
# appgroup_exec_t file with runcon command
# Example: appgroup_entrypoint(appgroup2_t)
interface(`appgroup_entrypoint',`
	gen_require(`
		type appgroup_exec_t;
	')
	allow $1 appgroup_exec_t:file entrypoint;
')

# This interface should be called from all roles and user domains
# that should be authorized to execute files in the appgroup domain.
# Example: appgroup_role(confined_r, confined_t)
interface(`appgroup_role',`
	gen_require(`
		type appgroup_t;
	')

	role $1 types appgroup_t;
	appgroup_autotrans($2)

	allow $2 appgroup_t:dir list_dir_perms;
	read_files_pattern($2, appgroup_t, appgroup_t)
	read_lnk_files_pattern($2, appgroup_t, appgroup_t)
	
	allow $2 appgroup_t:fd use;
	
	allow $2 appgroup_t:process {sigchld sigkill sigstop signull signal };

	allow $2 appgroup_t:unix_dgram_socket create_stream_socket_perms;
	allow $2 appgroup_t:unix_stream_socket { connectto create_stream_socket_perms };
')