## <summary>Policy for containers</summary>

#######################################
## <summary>
##	The template to define a container domain.
## </summary>
## <param name="domain_prefix">
##	<summary>
##	Domain prefix to be used.
##	</summary>
## </param>
#
template(`container_domain_template',`
	gen_require(`
		attribute_role container_roles;
		attribute container_domain;
	')

	type $1_t, container_domain;
	domain_type($1_t)
	domain_user_exemption_target($1_t)
	mls_rangetrans_target($1_t)
	mcs_constrained($1_t)
	role container_roles types $1_t;
')

########################################
## <summary>
##	The template to define a container
##	engine domain.
## </summary>
## <param name="domain_prefix">
##	<summary>
##	Domain prefix to be used.
##	</summary>
## </param>
#
template(`container_engine_domain_template',`
	gen_require(`
		attribute_role container_roles;
		attribute container_engine_domain;
	')

	type $1_t, container_engine_domain;
	role container_roles types $1_t;
	domain_type($1_t)
	domain_subj_id_change_exemption($1_t)
	domain_obj_id_change_exemption($1_t)
	domain_role_change_exemption($1_t)

	mls_file_read_to_clearance($1_t)
	mls_file_write_to_clearance($1_t)

	auth_use_nsswitch($1_t)
	storage_raw_rw_fixed_disk($1_t)

	optional_policy(`
		dbus_list_system_bus_runtime($1_t)
		dbus_system_bus_client($1_t)
	')
')

#######################################
## <summary>
##	Allow the specified container engine
##	domain all the rules required to
##	function as a system container engine.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_system_engine',`
	gen_require(`
		attribute container_engine_system_domain;
	')

	typeattribute $1 container_engine_system_domain;
')

#######################################
## <summary>
##	Allow the specified container engine
##	domain all the rules required to
##	function as a user container engine.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_user_engine',`
	gen_require(`
		attribute container_engine_user_domain;
	')

	typeattribute $1 container_engine_user_domain;
')

########################################
## <summary>
##	Base role access for containers. This
##	grants all the rules necessary for
##	common container usage.
## </summary>
## <param name="role_prefix">
##	<summary>
##	The prefix of the user role (e.g., user
##	is the prefix for user_r).
##	</summary>
## </param>
## <param name="user_domain">
##	<summary>
##	User domain for the role.
##	</summary>
## </param>
## <param name="user_exec_domain">
##	<summary>
##	User exec domain for execute and transition access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
#
template(`container_base_role',`
	gen_require(`
		type container_config_t;
	')

	container_run_generic_engine($3, $4)

	container_engine_dbus_chat($2)

	allow $3 self:cap_userns { kill sys_ptrace };

	files_search_etc($2)
	read_files_pattern($2, container_config_t, container_config_t)

	container_admin_all_files($2)
	container_admin_all_ro_files($2)
')

########################################
## <summary>
##	Role access for system containers.
## </summary>
## <param name="role_prefix">
##	<summary>
##	The prefix of the user role (e.g., user
##	is the prefix for user_r).
##	</summary>
## </param>
## <param name="user_domain">
##	<summary>
##	User domain for the role.
##	</summary>
## </param>
## <param name="user_exec_domain">
##	<summary>
##	User exec domain for execute and transition access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
#
template(`container_system_role',`
	gen_require(`
		attribute container_system_domain;
		attribute container_engine_system_domain;
	')

	role $4 types container_engine_system_domain;

	container_base_role($1, $2, $3, $4)

	allow container_system_domain $3:unix_stream_socket rw_stream_socket_perms;

	allow $3 container_engine_system_domain:process { ptrace signal_perms };
	ps_process_pattern($3, container_engine_system_domain)
')

########################################
## <summary>
##	Role access for user containers.
## </summary>
## <param name="role_prefix">
##	<summary>
##	The prefix of the user role (e.g., user
##	is the prefix for user_r).
##	</summary>
## </param>
## <param name="user_domain">
##	<summary>
##	User domain for the role.
##	</summary>
## </param>
## <param name="user_exec_domain">
##	<summary>
##	User exec domain for execute and transition access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
#
template(`container_user_role',`
	gen_require(`
		attribute container_user_domain;
		attribute container_engine_user_domain;
	')

	role $4 types container_user_domain;

	container_base_role($1, $2, $3, $4)

	allow container_user_domain $3:unix_stream_socket rw_stream_socket_perms;

	allow $3 container_user_domain:process { ptrace signal_perms };
	ps_process_pattern($3, container_user_domain)

	container_admin_all_user_runtime_content($2)
	container_manage_all_home_content($2)

	optional_policy(`
		systemd_read_user_manager_state($1, container_engine_user_domain)
		systemd_user_manager_system_start($1, container_engine_user_domain)
		systemd_user_manager_system_stop($1, container_engine_user_domain)
		systemd_user_manager_system_status($1, container_engine_user_domain)
		systemd_user_manager_dbus_chat($1, container_engine_user_domain)

		systemd_user_app_status($1, container_user_domain)
	')

	optional_policy(`
		docker_user_role($1, $2, $3, $4)
	')

	optional_policy(`
		podman_user_role($1, $2, $3, $4)
	')
')

########################################
## <summary>
##	Unconfined role access for containers.
## </summary>
## <param name="role_prefix">
##	<summary>
##	The prefix of the user role (e.g., user
##	is the prefix for user_r).
##	</summary>
## </param>
## <param name="user_domain">
##	<summary>
##	User domain for the role.
##	</summary>
## </param>
## <param name="user_exec_domain">
##	<summary>
##	User exec domain for execute and transition access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
#
template(`container_unconfined_role',`
	gen_require(`
		attribute container_domain;
		type container_config_t;
	')

	role $4 types container_domain;

	allow $3 container_domain:process transition;
	allow $3 container_domain:process2 { nnp_transition nosuid_transition };
	allow container_domain $3:fd use;
	allow container_domain $3:unix_stream_socket rw_stream_socket_perms;

	allow $3 self:cap_userns { kill sys_ptrace };

	allow $3 container_domain:process { ptrace signal_perms };
	ps_process_pattern($3, container_domain)

	files_search_etc($2)
	read_files_pattern($2, container_config_t, container_config_t)

	container_admin_all_files($2)
	container_admin_all_ro_files($2)

	container_admin_all_user_runtime_content($2)
	container_manage_all_home_content($2)
')

########################################
## <summary>
##	Execute generic container engines in the
##	container engine domain.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed to transition.
## </summary>
## </param>
#
interface(`container_domtrans_generic_engine',`
	gen_require(`
		type container_engine_t, container_engine_exec_t;
	')

	corecmd_search_bin($1)
	domtrans_pattern($1, container_engine_exec_t, container_engine_t)
')

########################################
## <summary>
##	Execute generic container engines in the
##	container engine domain, and allow the
##	specified role the container domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	The role to be allowed the container domain.
##	</summary>
## </param>
#
interface(`container_run_generic_engine',`
	gen_require(`
		attribute_role container_roles;
	')

	container_domtrans_generic_engine($1)
	roleattribute $2 container_roles;
')

########################################
## <summary>
##	Make the specified type usable for files
##	that are executables for container engines.
## </summary>
## <param name="type">
##	<summary>
##	Type to be used for files.
##	</summary>
## </param>
#
interface(`container_engine_executable_file',`
	gen_require(`
		attribute container_engine_exec_type;
	')

	typeattribute $1 container_engine_exec_type;

	application_executable_file($1)
')

########################################
## <summary>
##	Execute a generic container engine
##	executable with an automatic transition
##	to a private type.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
## <param name="target_domain">
##	<summary>
##	The type of the new process.
##	</summary>
## </param>
#
interface(`container_generic_engine_domtrans',`
	gen_require(`
		type container_engine_exec_t;
	')

	corecmd_search_bin($1)
	domtrans_pattern($1, container_engine_exec_t, $2)
')

########################################
## <summary>
##	Allow the generic container engine
##	executables to be an entrypoint
##	for the specified domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_engine_executable_entrypoint',`
	gen_require(`
		type container_engine_exec_t;
	')

	allow $1 container_engine_exec_t:file entrypoint;
')

########################################
## <summary>
##	Send and receive messages from
##	container engines over dbus.
## </summary>
## <param name="domain">
## <summary>
##	Domain allowed access.
## </summary>
## </param>
#
interface(`container_engine_dbus_chat',`
	gen_require(`
		attribute container_engine_domain;
		class dbus send_msg;
	')

	allow $1 container_engine_domain:dbus send_msg;
	allow container_engine_domain $1:dbus send_msg;
')

########################################
## <summary>
##	Allow the specified domain to be started
##	by systemd socket activation using a
##	named socket labeled the container
##	runtime type.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_runtime_named_socket_activation',`
	gen_require(`
		type container_runtime_t;
	')

	init_named_socket_activation($1, container_runtime_t)
')

########################################
## <summary>
##	Allow the specified domain to search
##	container engine temporary directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_search_engine_tmp',`
	gen_require(`
		type container_engine_tmp_t;
	')

	files_search_tmp($1)
	allow $1 container_engine_tmp_t:dir search_dir_perms;
')

########################################
## <summary>
##	Allow the specified domain to manage
##	container engine temporary files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_engine_tmp_files',`
	gen_require(`
		type container_engine_tmp_t;
	')

	container_search_engine_tmp($1)
	allow $1 container_engine_tmp_t:file manage_file_perms;
')

########################################
## <summary>
##	Allow the specified domain to manage
##	container engine temporary named sockets.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_engine_tmp_sock_files',`
	gen_require(`
		type container_engine_tmp_t;
	')

	container_search_engine_tmp($1)
	allow $1 container_engine_tmp_t:sock_file manage_sock_file_perms;
')

########################################
## <summary>
##	Allow the specified domain to create
##	objects in generic temporary directories
##	with an automatic type transition to
##	the container engine temporary file type.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="object">
##	<summary>
##	The object class of the object being created.
##	</summary>
## </param>
## <param name="name" optional="true">
##	<summary>
##	The name of the object being created.
##	</summary>
## </param>
#
interface(`container_engine_tmp_filetrans',`
	gen_require(`
		type container_engine_tmp_t;
	')

	files_tmp_filetrans($1, container_engine_tmp_t, $2, $3)
')

########################################
## <summary>
##	Read the process state (/proc/pid)
##	of all containers.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_read_all_container_state',`
	gen_require(`
		attribute container_domain;
	')

	ps_process_pattern($1, container_domain)
')

########################################
## <summary>
##	Read the process state (/proc/pid)
##	of all system containers.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_read_system_container_state',`
	gen_require(`
		attribute container_system_domain;
	')

	ps_process_pattern($1, container_system_domain)
')

########################################
## <summary>
##	Read the process state (/proc/pid)
##	of all user containers.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_read_user_container_state',`
	gen_require(`
		attribute container_user_domain;
	')

	ps_process_pattern($1, container_user_domain)
')

########################################
## <summary>
##	Read the process state (/proc/pid)
##	of all container engines.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_read_all_container_engine_state',`
	gen_require(`
		attribute container_engine_domain;
	')

	ps_process_pattern($1, container_engine_domain)
')

########################################
## <summary>
##	All of the permissions necessary
##	for a container engine to manage
##	container processes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_all_containers',`
	gen_require(`
		attribute container_domain;
	')

	allow $1 container_domain:process { getattr getsched setsched sigkill signal signull transition };
')

########################################
## <summary>
##	Allow the specified domain to
##	perform a type transition to
##	container domains.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
#
interface(`container_domtrans',`
	gen_require(`
		attribute container_domain;
	')

	allow $1 container_domain:process transition;
')

########################################
## <summary>
##	Execute FUSEFS files with a type
##	transition to the super privileged
##	container type.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_fusefs_domtrans_spc',`
	gen_require(`
		type spc_t;
	')

	fs_fusefs_domtrans($1, spc_t)
')

########################################
## <summary>
##	Connect to a system container engine
##	domain over a unix stream socket.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_stream_connect_system_engine',`
	gen_require(`
		attribute container_engine_system_domain;
		type container_runtime_t;
	')

	files_search_runtime($1)
	stream_connect_pattern($1, container_runtime_t, container_runtime_t, container_engine_system_domain)
	allow $1 container_runtime_t:sock_file read_sock_file_perms;
')

########################################
## <summary>
##	Connect to a system container domain
##	over a unix stream socket.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_stream_connect_system_containers',`
	gen_require(`
		attribute container_system_domain;
		type container_runtime_t;
	')

	files_search_runtime($1)
	stream_connect_pattern($1, container_runtime_t, container_runtime_t, container_system_domain)
	allow $1 container_runtime_t:sock_file read_sock_file_perms;
')

########################################
## <summary>
##	Connect to a user container domain
##	over a unix stream socket.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_stream_connect_user_containers',`
	gen_require(`
		attribute container_user_domain;
		type container_runtime_t;
	')

	files_search_runtime($1)
	stream_connect_pattern($1, container_runtime_t, container_runtime_t, container_user_domain)
	allow $1 container_runtime_t:sock_file read_sock_file_perms;
')

########################################
## <summary>
##	Connect to super privileged containers
##	over a unix stream socket.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_stream_connect_spc',`
	gen_require(`
		type container_runtime_t;
		type spc_t;
	')

	files_search_runtime($1)
	stream_connect_pattern($1, container_runtime_t, container_runtime_t, spc_t)
	allow $1 container_runtime_t:sock_file read_sock_file_perms;
')

########################################
## <summary>
##	Read and write super privileged
##	container TCP sockets.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_rw_spc_tcp_sockets',`
	gen_require(`
		type spc_t;
	')

	allow $1 spc_t:tcp_socket rw_stream_socket_perms;
')

########################################
## <summary>
##	Connect to a container domain
##	over a unix stream socket.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_stream_connect_all_containers',`
	gen_require(`
		attribute container_domain;
		type container_runtime_t;
	')

	files_search_runtime($1)
	stream_connect_pattern($1, container_runtime_t, container_runtime_t, container_domain)
	allow $1 container_runtime_t:sock_file read_sock_file_perms;
')

########################################
## <summary>
##	Connect to the specified container
##	domain over a unix stream socket.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_stream_connect_spec_container',`
	gen_require(`
		type container_runtime_t;
	')

	files_search_runtime($1)
	stream_connect_pattern($1, container_runtime_t, container_runtime_t, $2)
	allow $1 container_runtime_t:sock_file read_sock_file_perms;
')

########################################
## <summary>
##	Allow the specified domain to
##	send a kill signal to all containers.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
#
interface(`container_kill_all_containers',`
	gen_require(`
		attribute container_domain;
	')

	allow $1 container_domain:process sigkill;
')

########################################
## <summary>
##	Allow the specified domain to
##	send all signals to a container
##	domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
#
interface(`container_signal_all_containers',`
	gen_require(`
		attribute container_domain;
	')

	allow $1 container_domain:process signal_perms;
')

########################################
## <summary>
##	Send signals to a system container.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_signal_system_containers',`
	gen_require(`
		attribute container_system_domain;
	')

	allow $1 container_system_domain:process signal;
')

########################################
## <summary>
##	Create objects in /dev with an automatic
##	transition to the container device type.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="object">
##	<summary>
##	The object class of the object being created.
##	</summary>
## </param>
## <param name="name" optional="true">
##	<summary>
##	The name of the object being created.
##	</summary>
## </param>
#
interface(`container_dev_filetrans',`
	gen_require(`
		type container_device_t;
	')

	dev_filetrans($1, container_device_t, $2, $3)
')

########################################
## <summary>
##	Read and write container device files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_rw_device_files',`
	gen_require(`
		type container_device_t;
	')

	allow $1 container_device_t:file rw_file_perms;
')

########################################
## <summary>
##	Manage container device files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_device_files',`
	gen_require(`
		type container_device_t;
	')

	allow $1 container_device_t:file manage_file_perms;
')

########################################
## <summary>
##	Get the attributes of container device
##	block files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_getattr_device_blk_files',`
	gen_require(`
		type container_device_t;
	')

	allow $1 container_device_t:blk_file getattr;
')

########################################
## <summary>
##	Read container device block files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_read_device_blk_files',`
	gen_require(`
		type container_device_t;
	')

	allow $1 container_device_t:blk_file read_blk_file_perms;
')

########################################
## <summary>
##	Mount on all container devices.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_mounton_all_devices',`
	gen_require(`
		type container_device_t;
	')

	allow $1 container_device_t:dir_file_class_set mounton;
')

########################################
## <summary>
##	Set the attributes of container ptys.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_setattr_container_ptys',`
	gen_require(`
		type container_devpts_t;
	')

	allow $1 container_devpts_t:chr_file setattr;
')

########################################
## <summary>
##	Read and write container ptys.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_use_container_ptys',`
	gen_require(`
		type container_devpts_t;
	')

	allow $1 container_devpts_t:chr_file rw_term_perms;
')

########################################
## <summary>
##	Make the specified type usable as a mountpoint
##	for containers.
## </summary>
## <param name="file_type">
##	<summary>
##	Type to be used as a mountpoint.
##	</summary>
## </param>
#
interface(`container_mountpoint',`
	gen_require(`
		attribute container_mountpoint_type;
	')

	typeattribute $1 container_mountpoint_type;
')

########################################
## <summary>
##	Allow the specified domain to
##	list the contents of container
##	plugin directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_list_plugin_dirs',`
	gen_require(`
		type container_plugin_t;
	')

	allow $1 container_plugin_t:dir list_dir_perms;
')

########################################
## <summary>
##	Allow the specified domain to
##	add a watch on container plugin
##	directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_watch_plugin_dirs',`
	gen_require(`
		type container_plugin_t;
	')

	allow $1 container_plugin_t:dir watch;
')

########################################
## <summary>
##	Allow the specified domain to
##	manage container plugin files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_plugin_files',`
	gen_require(`
		type container_plugin_t;
	')

	manage_files_pattern($1, container_plugin_t, container_plugin_t)
')

########################################
## <summary>
##	Allow the specified domain to
##	execute container plugins.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_exec_plugins',`
	gen_require(`
		type container_plugin_t;
	')

	container_list_plugin_dirs($1)
	can_exec($1, container_plugin_t)
')

########################################
## <summary>
##	Allow the specified domain to
##	search container config directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_search_config',`
	gen_require(`
		type container_config_t;
	')

    files_search_etc($1)
    allow $1 container_config_t:dir search_dir_perms;
')

########################################
## <summary>
##	Allow the specified domain to
##	read container config files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_read_config',`
	gen_require(`
		type container_config_t;
	')

	list_dirs_pattern($1, container_config_t, container_config_t)
	read_files_pattern($1, container_config_t, container_config_t)
')

########################################
## <summary>
##	Allow the specified domain to
##	watch container config directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_watch_config_dirs',`
	gen_require(`
		type container_config_t;
	')

	allow $1 container_config_t:dir watch;
')

########################################
## <summary>
##	Allow the specified domain to
##	create container config files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_create_config_files',`
	gen_require(`
		type container_config_t;
	')

	create_files_pattern($1, container_config_t, container_config_t)
')

########################################
## <summary>
##	Allow the specified domain to read
##	and write container config files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_rw_config_files',`
	gen_require(`
		type container_config_t;
	')

	rw_files_pattern($1, container_config_t, container_config_t)
')

########################################
## <summary>
##	Allow the specified domain to
##	manage container config files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_config_files',`
	gen_require(`
		type container_config_t;
	')

	manage_files_pattern($1, container_config_t, container_config_t)
')

########################################
## <summary>
##	Allow the specified domain to
##	create container files in the
##	root directory with a type
##	transition.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_file_root_filetrans',`
	gen_require(`
		type container_file_t;
	')

	files_root_filetrans($1, container_file_t, dir_file_class_set)
')

########################################
## <summary>
##	Allow the specified domain to
##	manage container file directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_dirs',`
	gen_require(`
		type container_file_t;
	')

	manage_dirs_pattern($1, container_file_t, container_file_t)
')

########################################
## <summary>
##	Allow the specified domain to
##	watch container file directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_watch_dirs',`
	gen_require(`
		type container_file_t;
	')

	allow $1 container_file_t:dir watch;
')

########################################
## <summary>
##	Allow the specified domain to
##	manage container files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_files',`
	gen_require(`
		type container_file_t;
	')

	manage_files_pattern($1, container_file_t, container_file_t)
')

########################################
## <summary>
##	IOCTL container files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_ioctl_files',`
	gen_require(`
		type container_file_t;
	')

	allow $1 container_file_t:file ioctl;
')

########################################
## <summary>
##	Do not audit attempts to relabel
##	container file directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`container_dontaudit_relabel_dirs',`
	gen_require(`
		type container_file_t;
	')

	dontaudit $1 container_file_t:dir { relabelfrom relabelto };
')

########################################
## <summary>
##	Do not audit attempts to relabel
##	container files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`container_dontaudit_relabel_files',`
	gen_require(`
		type container_file_t;
	')

	dontaudit $1 container_file_t:file { relabelfrom relabelto };
')

########################################
## <summary>
##	Allow the specified domain to
##	manage container lnk files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_lnk_files',`
	gen_require(`
		type container_file_t;
	')

	manage_lnk_files_pattern($1, container_file_t, container_file_t)
')

########################################
## <summary>
##	Allow the specified domain to
##	read and write container fifo files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_rw_fifo_files',`
	gen_require(`
		type container_file_t;
	')

	rw_fifo_files_pattern($1, container_file_t, container_file_t)
')

########################################
## <summary>
##	Allow the specified domain to
##	manage container fifo files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_fifo_files',`
	gen_require(`
		type container_file_t;
	')

	manage_fifo_files_pattern($1, container_file_t, container_file_t)
')

########################################
## <summary>
##	Allow the specified domain to
##	manage container sock files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_sock_files',`
	gen_require(`
		type container_file_t;
	')

	manage_sock_files_pattern($1, container_file_t, container_file_t)
')

########################################
## <summary>
##	Allow the specified domain to read
##	and write container chr files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_rw_chr_files',`
	gen_require(`
		type container_file_t;
	')

	allow $1 container_file_t:chr_file rw_chr_file_perms;
')

########################################
## <summary>
##	Do not audit attempts to read
##	and write container chr files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_dontaudit_rw_chr_files',`
	gen_require(`
		type container_file_t;
	')

	dontaudit $1 container_file_t:chr_file rw_chr_file_perms;
')

########################################
## <summary>
##	Allow the specified domain to
##	manage container chr files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_chr_files',`
	gen_require(`
		type container_file_t;
	')

	manage_chr_files_pattern($1, container_file_t, container_file_t)
')

########################################
## <summary>
##	Allow the specified domain to create
##	objects in specified directories with
##	an automatic type transition to the
##	container file type.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="domain">
##	<summary>
##	Directory to transition on.
##	</summary>
## </param>
## <param name="object">
##	<summary>
##	The object class of the object being created.
##	</summary>
## </param>
## <param name="name" optional="true">
##	<summary>
##	The name of the object being created.
##	</summary>
## </param>
#
interface(`container_spec_filetrans_file',`
	gen_require(`
		type container_file_t;
	')

	filetrans_pattern($1, $2, container_file_t, $3, $4)
')

########################################
## <summary>
##	Allow the specified domain to get
##	the attributes of all container
##	file objects.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_getattr_all_files',`
	gen_require(`
		type container_file_t;
	')

	allow $1 container_file_t:dir_file_class_set getattr;
')

########################################
## <summary>
##	Allow the specified domain to list
##	the contents of read-only container
##	file directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_list_ro_dirs',`
	gen_require(`
		type container_ro_file_t;
	')

	allow $1 container_ro_file_t:dir list_dir_perms;
')

########################################
## <summary>
##	Allow the specified domain to get
##	the attributes of all read-only
##	container file objects.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_getattr_all_ro_files',`
	gen_require(`
		type container_ro_file_t;
	')

	allow $1 container_ro_file_t:dir_file_class_set getattr;
')

########################################
## <summary>
##	Read container config home content.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_read_home_config',`
	gen_require(`
		type container_conf_home_t;
	')

	userdom_search_user_home_dirs($1)
	xdg_search_config_dirs($1)
	read_files_pattern($1, container_conf_home_t, container_conf_home_t)
')

########################################
## <summary>
##	Allow the specified domain to
##	manage container config home content.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_home_config',`
	gen_require(`
		type container_conf_home_t;
	')

	allow $1 container_conf_home_t:dir manage_dir_perms;
	allow $1 container_conf_home_t:file manage_file_perms;
')

########################################
## <summary>
##	Allow the specified domain to create
##	objects in an xdg_config directory
##	with an automatic type transition to
##	the container config home type.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="object">
##	<summary>
##	The object class of the object being created.
##	</summary>
## </param>
## <param name="name" optional="true">
##	<summary>
##	The name of the object being created.
##	</summary>
## </param>
#
interface(`container_config_home_filetrans',`
	gen_require(`
		type container_conf_home_t;
	')

	xdg_search_config_dirs($1)
	xdg_config_filetrans($1, container_conf_home_t, $2, $3)
')

########################################
## <summary>
##	Allow the specified domain to
##	manage container data home files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_home_data_files',`
	gen_require(`
		type container_data_home_t;
	')

	manage_files_pattern($1, container_data_home_t, container_data_home_t)
')

########################################
## <summary>
##	Allow the specified domain to
##	manage container data home named
##	pipes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_home_data_fifo_files',`
	gen_require(`
		type container_data_home_t;
	')

	manage_fifo_files_pattern($1, container_data_home_t, container_data_home_t)
')

########################################
## <summary>
##	Allow the specified domain to
##	manage container data home named
##	sockets.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_home_data_sock_files',`
	gen_require(`
		type container_data_home_t;
	')

	manage_sock_files_pattern($1, container_data_home_t, container_data_home_t)
')

########################################
## <summary>
##	Administrate all container files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_admin_all_files',`
	gen_require(`
		type container_file_t;
	')

	admin_pattern($1, container_file_t)
	allow $1 container_file_t:chr_file manage_chr_file_perms;
	allow $1 container_file_t:blk_file manage_blk_file_perms;
')

########################################
## <summary>
##	Administrate all container read-only files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_admin_all_ro_files',`
	gen_require(`
		type container_ro_file_t;
	')

	admin_pattern($1, container_ro_file_t)
	allow $1 container_ro_file_t:chr_file manage_chr_file_perms;
	allow $1 container_ro_file_t:blk_file manage_blk_file_perms;
')

########################################
## <summary>
##	All of the rules necessary for a user
##	to manage user container runtime data
##	in their user runtime directory.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_admin_all_user_runtime_content',`
	gen_require(`
		type container_user_runtime_t;
	')

	admin_pattern($1, container_user_runtime_t)
')

########################################
## <summary>
##	All of the rules necessary for a user
##	to manage container data in their home
##	directory.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_all_home_content',`
	gen_require(`
		type container_file_t, container_ro_file_t;
		type container_cache_home_t, container_conf_home_t;
		type container_data_home_t;
	')

	allow $1 container_cache_home_t:dir { manage_dir_perms relabel_dir_perms };
	allow $1 container_cache_home_t:file { manage_file_perms relabel_file_perms };
	xdg_cache_filetrans($1, container_cache_home_t, dir, "containers")

	allow $1 container_conf_home_t:dir { manage_dir_perms relabel_dir_perms };
	allow $1 container_conf_home_t:file { manage_file_perms relabel_file_perms };
	xdg_config_filetrans($1, container_conf_home_t, dir, "containers")

	allow $1 container_data_home_t:dir { manage_dir_perms relabel_dir_perms };
	allow $1 container_data_home_t:file { manage_file_perms relabel_file_perms };
	allow $1 container_data_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
	allow $1 container_data_home_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
	allow $1 container_data_home_t:sock_file { manage_sock_file_perms relabel_sock_file_perms };
	allow $1 container_data_home_t:chr_file { manage_chr_file_perms relabel_chr_file_perms };
	allow $1 container_data_home_t:blk_file { manage_blk_file_perms relabel_blk_file_perms };
	xdg_data_filetrans($1, container_data_home_t, dir, "containers")
	filetrans_pattern($1, container_data_home_t, container_ro_file_t, dir, "overlay")
	filetrans_pattern($1, container_data_home_t, container_ro_file_t, dir, "overlay-images")
	filetrans_pattern($1, container_data_home_t, container_ro_file_t, dir, "overlay-layers")
	filetrans_pattern($1, container_data_home_t, container_ro_file_t, dir, "overlay2")
	filetrans_pattern($1, container_data_home_t, container_ro_file_t, dir, "overlay2-images")
	filetrans_pattern($1, container_data_home_t, container_ro_file_t, dir, "overlay2-layers")
	filetrans_pattern($1, container_data_home_t, container_file_t, dir, "volumes")
')

########################################
## <summary>
##	Allow the specified domain to
##	relabel container files and
##	directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_relabel_all_content',`
	gen_require(`
		type container_file_t;
	')

	allow $1 container_file_t:dir_file_class_set { relabelfrom relabelto };
')

########################################
## <summary>
##	Allow the specified domain to
##	remount container filesystems.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_remount_fs',`
	gen_require(`
		type container_file_t;
	')

	allow $1 container_file_t:filesystem remount;
')

########################################
## <summary>
##	Allow the specified domain to
##	relabel container filesystems.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_relabel_fs',`
	gen_require(`
		type container_file_t;
	')

	allow $1 container_file_t:filesystem { relabelfrom relabelto };
')

########################################
## <summary>
##	Allow the specified domain to
##	get the attributes of container
##	filesystems.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_getattr_fs',`
	gen_require(`
		type container_file_t;
	')

	allow $1 container_file_t:filesystem getattr;
')

########################################
## <summary>
##	Allow the specified domain to search
##	runtime container directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_search_runtime',`
	gen_require(`
		type container_runtime_t;
	')

	files_search_runtime($1)
	allow $1 container_runtime_t:dir search_dir_perms;
')

########################################
## <summary>
##	Allow the specified domain to read
##	runtime container files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_read_runtime_files',`
	gen_require(`
		type container_runtime_t;
	')

	files_search_runtime($1)
	allow $1 container_runtime_t:file read_file_perms;
')

########################################
## <summary>
##	Allow the specified domain to get
##	the attributes runtime container of
##	container runtime named sockets.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_getattr_runtime_sock_files',`
	gen_require(`
		type container_runtime_t;
	')

	allow $1 container_runtime_t:sock_file getattr;
')

########################################
## <summary>
##	Allow the specified domain to create
##	runtime container directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_create_runtime_dirs',`
	gen_require(`
		type container_runtime_t;
	')

	create_dirs_pattern($1, container_runtime_t, container_runtime_t)
')

########################################
## <summary>
##	Allow the specified domain to manage
##	runtime container files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_runtime_files',`
	gen_require(`
		type container_runtime_t;
	')

	manage_files_pattern($1, container_runtime_t, container_runtime_t)
')

########################################
## <summary>
##	Allow the specified domain to manage
##	runtime container named pipes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_runtime_fifo_files',`
	gen_require(`
		type container_runtime_t;
	')

	manage_fifo_files_pattern($1, container_runtime_t, container_runtime_t)
')

########################################
## <summary>
##	Allow the specified domain to manage
##	runtime container symlinks.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_runtime_lnk_files',`
	gen_require(`
		type container_runtime_t;
	')

	manage_lnk_files_pattern($1, container_runtime_t, container_runtime_t)
')

########################################
## <summary>
##	Allow the specified domain to manage
##	runtime container named sockets.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_runtime_sock_files',`
	gen_require(`
		type container_runtime_t;
	')

	manage_sock_files_pattern($1, container_runtime_t, container_runtime_t)
')

########################################
## <summary>
##	Allow the specified domain to manage
##	user runtime container files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_user_runtime_files',`
	gen_require(`
		type container_user_runtime_t;
	')

	manage_files_pattern($1, container_user_runtime_t, container_user_runtime_t)
')

########################################
## <summary>
##	Allow the specified domain to read and
##	write user runtime container named sockets.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_rw_user_runtime_sock_files',`
	gen_require(`
		type container_user_runtime_t;
	')

	allow $1 container_user_runtime_t:sock_file rw_sock_file_perms;
')

########################################
## <summary>
##	Allow the specified domain to search
##	container directories in /var/lib.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_search_var_lib',`
	gen_require(`
		type container_var_lib_t;
	')

	files_search_var_lib($1)
	allow $1 container_var_lib_t:dir search_dir_perms;
')

########################################
## <summary>
##	Allow the specified domain to list
##	the contents of container directories
##	in /var/lib.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_list_var_lib',`
	gen_require(`
		type container_var_lib_t;
	')

	files_search_var_lib($1)
	allow $1 container_var_lib_t:dir list_dir_perms;
')

########################################
## <summary>
##	Allow the specified domain to manage
##	container file directories in /var/lib.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_var_lib_dirs',`
	gen_require(`
		type container_var_lib_t;
	')

	manage_dirs_pattern($1, container_var_lib_t, container_var_lib_t)
')

########################################
## <summary>
##	Allow the specified domain to read
##	container files in /var/lib.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_read_var_lib_files',`
	gen_require(`
		type container_var_lib_t;
	')

	read_files_pattern($1, container_var_lib_t, container_var_lib_t)
')

########################################
## <summary>
##	Allow the specified domain to manage
##	container files in /var/lib.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_var_lib_files',`
	gen_require(`
		type container_var_lib_t;
	')

	manage_files_pattern($1, container_var_lib_t, container_var_lib_t)
')

########################################
## <summary>
##	Allow the specified domain to memory
##	map container files in /var/lib.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_map_var_lib_files',`
	gen_require(`
		type container_var_lib_t;
	')

	allow $1 container_var_lib_t:file map;
')

########################################
## <summary>
##	Allow the specified domain to manage
##	container named pipes in /var/lib.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_var_lib_fifo_files',`
	gen_require(`
		type container_var_lib_t;
	')

	manage_fifo_files_pattern($1, container_var_lib_t, container_var_lib_t)
')

########################################
## <summary>
##	Allow the specified domain to manage
##	container symlinks in /var/lib.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_var_lib_lnk_files',`
	gen_require(`
		type container_var_lib_t;
	')

	manage_lnk_files_pattern($1, container_var_lib_t, container_var_lib_t)
')

########################################
## <summary>
##	Allow the specified domain to manage
##	container named sockets in /var/lib.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_var_lib_sock_files',`
	gen_require(`
		type container_var_lib_t;
	')

	manage_sock_files_pattern($1, container_var_lib_t, container_var_lib_t)
')

########################################
## <summary>
##	Allow the specified domain to create
##	objects in /var/lib with an automatic
##	transition to the container var lib type.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="object">
##	<summary>
##	The object class of the object being created.
##	</summary>
## </param>
## <param name="name" optional="true">
##	<summary>
##	The name of the object being created.
##	</summary>
## </param>
#
interface(`container_var_lib_filetrans',`
	gen_require(`
		type container_var_lib_t;
	')

	files_var_lib_filetrans($1, container_var_lib_t, $2, $3)
')

########################################
## <summary>
##	Allow the specified domain to create
##	objects in /var/lib with an automatic
##	transition to the container file type.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="object">
##	<summary>
##	The object class of the object being created.
##	</summary>
## </param>
## <param name="name" optional="true">
##	<summary>
##	The name of the object being created.
##	</summary>
## </param>
#
interface(`container_var_lib_filetrans_file',`
	gen_require(`
		type container_file_t;
	')

	files_var_lib_filetrans($1, container_file_t, $2, $3)
')

########################################
## <summary>
##	Allow the specified domain to create
##	objects in container /var/lib directories
##	with an automatic transition to the
##	container file type.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="object">
##	<summary>
##	The object class of the object being created.
##	</summary>
## </param>
## <param name="name" optional="true">
##	<summary>
##	The name of the object being created.
##	</summary>
## </param>
#
interface(`container_filetrans_var_lib_file',`
	gen_require(`
		type container_var_lib_t;
		type container_file_t;
	')

	filetrans_pattern($1, container_var_lib_t, container_file_t, $2, $3)
')

########################################
## <summary>
##	Allow the specified domain to create
##	objects in unlabeled directories with
##	an automatic type transition to the
##	container var lib type.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="object">
##	<summary>
##	The object class of the object being created.
##	</summary>
## </param>
## <param name="name" optional="true">
##	<summary>
##	The name of the object being created.
##	</summary>
## </param>
#
interface(`container_unlabeled_var_lib_filetrans',`
	gen_require(`
		type container_var_lib_t;
	')

	# This access is to workaround an issue in Docker
	# See: https://github.com/moby/moby/issues/43088
	kernel_unlabeled_filetrans($1, container_var_lib_t, $2, $3)
')

########################################
## <summary>
##	Allow the specified domain to get
##	the attributes of all container
##	var lib objects.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_getattr_all_var_lib_files',`
	gen_require(`
		type container_var_lib_t;
	')

	allow $1 container_var_lib_t:dir_file_class_set getattr;
')

########################################
## <summary>
##	Allow the specified domain to search
##	container log file directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_search_logs',`
	gen_require(`
		type container_log_t;
	')

	logging_search_logs($1)
	allow $1 container_log_t:dir search_dir_perms;
')

########################################
## <summary>
##	Allow the specified domain to list
##	the contents of container log directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_list_log_dirs',`
	gen_require(`
		type container_log_t;
	')

	allow $1 container_log_t:dir list_dir_perms;
')

########################################
## <summary>
##	Allow the specified domain to create
##	container log file directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_create_log_dirs',`
	gen_require(`
		type container_log_t;
	')

	allow $1 container_log_t:dir create_dir_perms;
')

########################################
## <summary>
##	Allow the specified domain to manage
##	container log file directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_log_dirs',`
	gen_require(`
		type container_log_t;
	')

	allow $1 container_log_t:dir manage_dir_perms;
')

########################################
## <summary>
##	Allow the specified domain to watch
##	container log file directories.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_watch_log_dirs',`
	gen_require(`
		type container_log_t;
	')

	allow $1 container_log_t:dir watch;
')

########################################
## <summary>
##	Allow the specified domain to create
##	container log files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_create_log_files',`
	gen_require(`
		type container_log_t;
	')

	create_files_pattern($1, container_log_t, container_log_t)
')

########################################
## <summary>
##	Allow the specified domain to append
##	data to container log files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_append_log_files',`
	gen_require(`
		type container_log_t;
	')

	allow $1 container_log_t:file append_file_perms;
')

########################################
## <summary>
##	Allow the specified domain to manage
##	container log files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_log_files',`
	gen_require(`
		type container_log_t;
	')

	manage_files_pattern($1, container_log_t, container_log_t)
')

########################################
## <summary>
##	Allow the specified domain to watch
##	container log files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_watch_log_files',`
	gen_require(`
		type container_log_t;
	')

	allow $1 container_log_t:file watch;
')

########################################
## <summary>
##	Allow the specified domain to create
##	objects in log directories with an
##	automatic transition to the container
##	log type.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="object">
##	<summary>
##	The object class of the object being created.
##	</summary>
## </param>
## <param name="name" optional="true">
##	<summary>
##	The name of the object being created.
##	</summary>
## </param>
#
interface(`container_log_filetrans',`
	gen_require(`
		type container_log_t;
	')

	logging_search_logs($1)
	logging_log_filetrans($1, container_log_t, $2, $3)
')

########################################
## <summary>
##	Allow the specified domain to manage
##	container log symlinks.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_manage_log_symlinks',`
	gen_require(`
		type container_log_t;
	')

	manage_lnk_files_pattern($1, container_log_t, container_log_t)
')

########################################
## <summary>
##	Allow the specified domain to start
##	systemd units for containers.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`container_start_units',`
	gen_require(`
		type container_unit_t;
		class service start;
	')

	allow $1 container_unit_t:service start;
')

########################################
## <summary>
##	All of the rules required to
##	administrate a container
##	environment.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`container_admin',`
	gen_require(`
		attribute container_domain, container_engine_domain;
		type container_file_t, container_ro_file_t;
		type container_var_lib_t, container_runtime_t;
		type container_config_t, container_engine_cache_t;
		type container_engine_tmp_t, container_engine_tmpfs_t;
	')

	container_run_generic_engine($1, $2)

	allow $1 container_domain:process { ptrace signal_perms };
	ps_process_pattern($1, container_domain)

	allow $1 container_engine_domain:process { ptrace signal_perms };
	ps_process_pattern($1, container_engine_domain)

	allow $1 self:cap_userns { kill sys_admin sys_ptrace };

	files_search_var_lib($1)
	admin_pattern($1, container_var_lib_t)
	admin_pattern($1, container_file_t)
	admin_pattern($1, container_ro_file_t)

	allow $1 container_var_lib_t:blk_file { manage_blk_file_perms relabel_blk_file_perms };
	allow $1 container_file_t:blk_file { manage_blk_file_perms relabel_blk_file_perms };
	allow $1 container_ro_file_t:blk_file { manage_blk_file_perms relabel_blk_file_perms };

	files_search_var($1)
	admin_pattern($1, container_engine_cache_t)

	files_search_runtime($1)
	admin_pattern($1, container_runtime_t)

	files_search_etc($1)
	admin_pattern($1, container_config_t)

	files_search_tmp($1)
	admin_pattern($1, container_engine_tmp_t)

	fs_search_tmpfs($1)
	admin_pattern($1, container_engine_tmpfs_t)

	optional_policy(`
		docker_admin($1, $2)
	')

	optional_policy(`
		podman_admin($1, $2)
	')
')
