module bumblebee-nvidia 6.0.0;

require {
	type dmesg_t;
	type ldconfig_t;
	type var_log_t;
	type etc_t;
	type var_lib_t;
	type proc_t;
	type sssd_var_lib_t;
	type sssd_public_t;
	type bumblebee_t;
	type user_tmp_t;
	type xserver_misc_device_t;
	type system_dbusd_var_run_t;
	type unconfined_t;
	type udev_var_run_t;
	type mtrr_device_t;
	type dri_device_t;
	type tty_device_t;
	type sysfs_t;
	type urandom_device_t;
	type tmp_t;
	type system_dbusd_t;
	type systemd_logind_t;
	class dir { add_name open ioctl read lock getattr create search setattr write remove_name link unlink };
	class file { setattr append ioctl lock open getattr create read write rename unlink link };
	class process { execmem getpgid setpgid };
	class unix_stream_socket connectto;
	class netlink_kobject_uevent_socket { bind create setopt getattr };
	class chr_file { read ioctl write getattr open };
	class capability { setuid sys_rawio sys_tty_config sys_admin };
	class sock_file { write create unlink };
	class dbus send_msg;
}

#============= dmesg_t ==============
kernel_rw_kernel_sysctl(dmesg_t)

#============= ldconfig_t ==============
logging_write_generic_logs(ldconfig_t)
allow ldconfig_t var_log_t:file write;
allow ldconfig_t var_lib_t:file read;

#============= bumblebee_t ==============
allow bumblebee_t proc_t:file write;
allow bumblebee_t dri_device_t:chr_file { read write ioctl open getattr };
allow bumblebee_t mtrr_device_t:file { write open };
allow bumblebee_t self:capability { setuid sys_rawio sys_tty_config sys_admin };
allow bumblebee_t self:netlink_kobject_uevent_socket { bind create setopt getattr };
allow bumblebee_t self:process { execmem getpgid setpgid };
allow bumblebee_t sysfs_t:file write;
allow bumblebee_t system_dbusd_t:unix_stream_socket connectto;
allow bumblebee_t system_dbusd_var_run_t:dir search;
allow bumblebee_t system_dbusd_var_run_t:sock_file write;
allow bumblebee_t tmp_t:dir { write remove_name add_name };
allow bumblebee_t tmp_t:file { write setattr create open rename unlink link };
allow bumblebee_t tty_device_t:chr_file open;
allow bumblebee_t udev_var_run_t:file { read getattr open };
allow bumblebee_t unconfined_t:dir search;
allow bumblebee_t unconfined_t:file { read open };
allow bumblebee_t urandom_device_t:chr_file { read getattr open ioctl };
allow bumblebee_t user_tmp_t:dir { write remove_name add_name };
allow bumblebee_t user_tmp_t:sock_file { create unlink };
allow bumblebee_t var_log_t:dir { write add_name remove_name };
allow bumblebee_t var_log_t:file { write create open unlink rename };
allow bumblebee_t xserver_misc_device_t:chr_file { read write getattr open ioctl };
allow bumblebee_t self:unix_stream_socket connectto;
allow bumblebee_t sssd_public_t:dir search;
allow bumblebee_t sssd_var_lib_t:dir search;
allow bumblebee_t udev_var_run_t:dir search;
allow bumblebee_t system_dbusd_t:dbus send_msg;
allow bumblebee_t systemd_logind_t:dbus send_msg;
#============= system_dbusd_t ==============
allow system_dbusd_t bumblebee_t:dbus send_msg;
allow system_dbusd_t systemd_logind_t:dbus send_msg;
#============= systemd_logind_t ==============
allow systemd_logind_t system_dbusd_t:dbus send_msg;
allow systemd_logind_t bumblebee_t:dbus send_msg;