policy_module(appgroup, 1.0.0)

########################################
#
# Declarations
#

# Type for files and application domain
type appgroup_t;

# Type of executable file
type appgroup_exec_t;

# The following calls are necessary for all file types
files_type(appgroup_t)
files_type(appgroup_exec_t)

# The following calls are necessary for all pairs
# application domain + executable file
domain_type(appgroup_t)
domain_entry_file(appgroup_t, appgroup_exec_t)


########################################
#
# Local policy
#

#----------------------------------------------------------
# MANDATORY - if you don't want to call these functions,
# equivalent privileges must be allowed manually
#----------------------------------------------------------

# Basic access to IPC objects, file descriptors,
# terminals and generic binary files of the same type
helper_self_permissions(appgroup_t)

# Access to X-server and DBUS subsystems
helper_dbus_basic(appgroup_t)
helper_xserver_basic(appgroup)
helper_basic_ipc(appgroup_t)

# Basic access to files (system, configuration...)
helper_files_basic(appgroup_t)

# Use basic devices (speakers, urandom, terminals...)
helper_devices_basic(appgroup_t)

# Access to modules from contrib layer
helper_contrib_modules_basic_access(appgroup_t)

# Choose one of these - the first for local applications
# or the second for network applications
helper_network_for_local_apps(appgroup_t)
helper_network_basic(appgroup_t)

#----------------------------------------------------------
# OPTIONAL - choose some combination of the following
# privileges to determine the character of the application
# category
#----------------------------------------------------------

# 1. Non-sensitive user data - choose 0 or 1
# a) none - no access to non-sensitive user data
# -
# b) access only to Downloads folder
helper_manage_download_data(appgroup_t)
# c) readonly access to non-sensitive user data
helper_read_user_data(appgroup_t)
# d) full access to non-sensitive user data
helper_manage_user_data(appgroup_t)

# 2. Sensitive user data - choose 0 or 1
# a) none - no access to sensitive user data
# -
# b) readonly access to sensitive data
helper_read_private_data(appgroup_t)
# c) full access to sensitive data
helper_manage_private_data(appgroup_t)

# 3. Network - choose 0 or 1
# a) none - for local applications
# -
# b) only web protocols
helper_network_web(appgroup_t)
# c) only mail protocols
helper_network_mail(appgroup_t)
# d) all protocols over TCP/UDP
helper_network_standard(appgroup_t)
# e) unlimited access, including raw devices
helper_network_unconfined(appgroup_t)

# 4. Devices - choose 0 or 1
# a) none - only basic access (speakers, terminals, ...
# as defined above)
# -
# b) access to webcam and microphone
helper_use_webcam_mic(appgroup_t)

########################################
#
# Access to other modules
#

# Call here any functions that ensure interaction
# between this module and other modules, i.e. communication
# over unix_stream_sockets or ability to execute files of
# a different type.