; -*- lisp -*-
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
;;;
;;; This file is part of GNU Guix.
;;;
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;;
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

;; This is a specification for SELinux 2.7 written in the SELinux Common
;; Intermediate Language (CIL).  It refers to types that must be defined in
;; the system's base policy.

(block guix_daemon
  ;;</td></tr></table>
<table class='tabs'><tr><td>
<a href='/guix/about/'>about</a><a href='/guix/'>summary</a><a href='/guix/refs/?id=382800fbf0b9b9cb6697ed4afb936cfaa63dcec2'>refs</a><a href='/guix/log/ROADMAP'>log</a><a href='/guix/tree/ROADMAP?id=382800fbf0b9b9cb6697ed4afb936cfaa63dcec2'>tree</a><a class='active' href='/guix/commit/ROADMAP?id=382800fbf0b9b9cb6697ed4afb936cfaa63dcec2'>commit</a><a href='/guix/diff/ROADMAP?id=382800fbf0b9b9cb6697ed4afb936cfaa63dcec2'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/ROADMAP'>
<input type='hidden' name='id' value='382800fbf0b9b9cb6697ed4afb936cfaa63dcec2'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/commit/?id=382800fbf0b9b9cb6697ed4afb936cfaa63dcec2'>root</a>/<a href='/guix/commit/ROADMAP?id=382800fbf0b9b9cb6697ed4afb936cfaa63dcec2'>ROADMAP</a></div><div class='content'><div class='cgit-panel'><b>diff options</b><form method='get'><input type='hidden' name='id' value='382800fbf0b9b9cb6697ed4afb936cfaa63dcec2'/><table><tr><td colspan='2'/></tr><tr><td class='label'>context:</td><td class='ctrl'><select name='context' onchange='this.form.submit();'><option value='1'>1</option><option value='2'>2</option><option value='3' selected='selected'>3</option><option value='4'>4</option><option value='5'>5</option><option value='6'>6</option><option value='7'>7</option><option value='8'>8</option><option value='9'>9</option><option value='10'>10</option><option value='15'>15</option><option value='20'>20</option><option value='25'>25</option><option value='30'>30</option><option value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'>
<tr><th>author</th><td>kiasoc5 &lt;kiasoc5@tutanota.com&gt;</td><td class='right'>2022-01-14 17:05:19 -0500</td></tr>
<tr><th>committer</th><td>Mathieu Othacehe &lt;othacehe@gnu.org&gt;</td><td class='right'>2022-01-20 14:48:16 +0100</td></tr>
<tr><th>commit</th><td colspan='2' class='oid'><a href='/guix/commit/ROADMAP?id=382800fbf0b9b9cb6697ed4afb936cfaa63dcec2'>382800fbf0b9b9cb6697ed4afb936cfaa63dcec2</a> (<a href='/guix/patch/ROADMAP?id=382800fbf0b9b9cb6697ed4afb936cfaa63dcec2'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='oid'><a href='/guix/tree/?id=382800fbf0b9b9cb6697ed4afb936cfaa63dcec2'>e5cc8cf1dc78c30050f0caf94e137dc9dc1da5d1</a> /<a href='/guix/tree/ROADMAP?id=382800fbf0b9b9cb6697ed4afb936cfaa63dcec2'>ROADMAP</a></td></tr>
<tr><th>parent</th><td colspan='2' class='oid'><a href='/guix/commit/ROADMAP?id=58baee6e0dbeab68d911e437aab30fd228e6ce5d'>58baee6e0dbeab68d911e437aab30fd228e6ce5d</a> (<a href='/guix/diff/ROADMAP?id=382800fbf0b9b9cb6697ed4afb936cfaa63dcec2&amp;id2=58baee6e0dbeab68d911e437aab30fd228e6ce5d'>diff</a>)</td></tr><tr><th>download</th><td colspan='2' class='oid'><a href='/guix/snapshot/guix-382800fbf0b9b9cb6697ed4afb936cfaa63dcec2.tar.gz'>guix-382800fbf0b9b9cb6697ed4afb936cfaa63dcec2.tar.gz</a><br/><a href='/guix/snapshot/guix-382800fbf0b9b9cb6697ed4afb936cfaa63dcec2.zip'>guix-382800fbf0b9b9cb6697ed4afb936cfaa63dcec2.zip</a><br/></td></tr></table>
<div class='commit-subject'>gnu: flatpak: Simplify inputs.</div><div class='commit-msg'>* gnu/packages/package-management.scm (flatpak)[native-inputs, inputs]: Remove labels.
[arguments]&lt;#:phases&gt;: Edit 'p11-kit-fix not to relying on labels.

Signed-off-by: Mathieu Othacehe &lt;othacehe@gnu.org&gt;
</div><div class='diffstat-header'><a href='/guix/diff/?id=382800fbf0b9b9cb6697ed4afb936cfaa63dcec2'>Diffstat</a> (limited to 'ROADMAP')</div><table summary='diffstat' class='diffstat'></table><div class='diffstat-summary'>0 files changed, 0 insertions, 0 deletions</div><table summary='diff' class='diff'><tr><td></td></tr></table></div> <!-- class=content -->
                         <div class=footer>generated by
                             <a href="https://git.zx2c4.com/cgit/about/">
                                 cgit
                             </a>
                         </div>
                        </div> <!-- id=cgit -->
</body>
</html>
           add_name remove_name
               open read write)))
  (allow guix_daemon_t
         guix_daemon_conf_t
         (file (create
                lock
                map
                getattr setattr
                unlink
                open read write)))
  (allow guix_daemon_t
         guix_daemon_conf_t
         (lnk_file (create getattr rename unlink)))

  ;; Access to profiles
  (allow guix_daemon_t
         guix_profiles_t
         (dir (getattr setattr read open)))
  (allow guix_daemon_t
         guix_profiles_t
         (lnk_file (read getattr)))

  ;; Access to profile links in the home directory
  ;; TODO: allow access to profile links *anywhere* on the filesystem
  (allow guix_daemon_t
         user_home_t
         (lnk_file (read getattr)))
  (allow guix_daemon_t
         user_home_t
         (dir (search)))

  ;; Socket operations
  (allow guix_daemon_t
         init_t
         (fd (use)))
  (allow guix_daemon_t
         init_t
         (unix_stream_socket (write)))
  (allow guix_daemon_t
         guix_daemon_conf_t
         (unix_stream_socket (listen)))
  (allow guix_daemon_t
         guix_daemon_conf_t
         (sock_file (create unlink)))
  (allow guix_daemon_t
         self
         (unix_stream_socket (create
                              read write
                              connect bind accept
                              getopt setopt)))
  (allow guix_daemon_t
         self
         (fifo_file (write read)))
  (allow guix_daemon_t
         self
         (udp_socket (ioctl create)))

  ;; Label file system
  (filecon "@guix_sysconfdir@/guix(/.*)?"
           any (system_u object_r guix_daemon_conf_t (low low)))
  (filecon "@guix_localstatedir@/guix(/.*)?"
           any (system_u object_r guix_daemon_conf_t (low low)))
  (filecon "@guix_localstatedir@/guix/profiles(/.*)?"
           any (system_u object_r guix_profiles_t (low low)))
  (filecon "/gnu"
           dir (unconfined_u object_r guix_store_content_t (low low)))
  (filecon "@storedir@(/.+)?"
           any (unconfined_u object_r guix_store_content_t (low low)))
  (filecon "@storedir@/[^/]+/.+"
           any (unconfined_u object_r guix_store_content_t (low low)))
  (filecon "@prefix@/bin/guix-daemon"
           file (system_u object_r guix_daemon_exec_t (low low)))
  (filecon "@storedir@/.+-(guix-.+|profile)/bin/guix-daemon"
           file (system_u object_r guix_daemon_exec_t (low low)))
  (filecon "@guix_localstatedir@/guix/daemon-socket/socket"
           any (system_u object_r guix_daemon_socket_t (low low))))