# Last Modified: Wed Mar  3 22:04:49 2010
#include <tunables/global>

/etc/init.d/origami {
  #include <abstractions/base>
  #include <abstractions/bash>

  capability dac_override,

  network inet dgram,
  network inet stream,

  /bin/pidof cx,
  /bin/ps cx,
  /bin/su cx,
  /sbin/killall5 cx,
  /usr/bin/taskset cx,

  /bin/bash ix,
  /bin/dash ix,
  /bin/grep mrix,
  /bin/sleep mrix,
  /bin/which mrix,
  /dev/tty rw,
  /etc/hosts r,
  /etc/init.d/origami r,
  /etc/nsswitch.conf r,
  /etc/resolv.conf r,
  /proc/sys/kernel/pid_max r,
  /proc/tty/drivers r,
  /proc/uptime r,
  /proc/version r,
  /tmp/fah/ rw,
  /tmp/fah/** rw,
  /tmp/fah/f* k,
  /usr/bin/cut mrix,
  /usr/bin/expr mrix,
  /usr/bin/getent mrix,
  /usr/bin/wc mrix,
  /var/lib/origami/** r,
  owner /var/lib/origami/foldingathome/CPU*/* r,
  owner /var/lib/origami/foldingathome/CPU*/Core_78.exe mwix,
  owner /var/lib/origami/foldingathome/CPU*/Core_78.fah wk,
  owner /var/lib/origami/foldingathome/CPU*/Core_b4.fah wk,
  owner /var/lib/origami/foldingathome/CPU*/FAHlog-Prev.txt wk,
  owner /var/lib/origami/foldingathome/CPU*/FAHlog.txt w,
  owner /var/lib/origami/foldingathome/CPU*/FaH mix,
  owner /var/lib/origami/foldingathome/CPU*/FahCore_78.exe mwkix,
  owner /var/lib/origami/foldingathome/CPU*/FahCore_b4.exe mwkix,
  owner /var/lib/origami/foldingathome/CPU*/MyFolding.html w,
  owner /var/lib/origami/foldingathome/CPU*/client.cfg wk,
  owner /var/lib/origami/foldingathome/CPU*/machinedependent.dat w,
  owner /var/lib/origami/foldingathome/CPU*/queue.dat w,
  owner /var/lib/origami/foldingathome/CPU*/unitinfo.txt w,
  owner /var/lib/origami/foldingathome/CPU*/work/ w,
  owner /var/lib/origami/foldingathome/CPU*/work/** wk,
  owner /var/lib/origami/foldingathome/fah6 mrix,
  owner /var/lib/origami/foldingathome/mpiexec mrix,

  profile /sbin/killall5 {
    #include <abstractions/base>

    capability kill,
    capability sys_ptrace,

    /proc/ r,
    /proc/[0-9]*/cmdline r,
    /proc/[0-9]*/stat r,
    /proc/[0-9]*/status r,
    /proc/version r,
    /proc/uptime r,
  }

  profile /bin/pidof {
    #include <abstractions/base>

    capability sys_ptrace,

    /proc/ r,
    /proc/[0-9]*/cmdline r,
    /proc/[0-9]*/stat r,
    /proc/[0-9]*/status r,
    /proc/version r,
    /proc/uptime r,
  }

  profile /bin/ps {
    #include <abstractions/base>

    capability sys_ptrace,

    /proc/ r,
    /proc/[0-9]*/cmdline r,
    /proc/[0-9]*/stat r,
    /proc/[0-9]*/status r,
    /proc/version r,
    /proc/uptime r,
  }
    

  profile /bin/su {
    #include <abstractions/base>

    capability setgid,
    capability setuid,
    
    owner /etc/default/locale r,
    owner /etc/environment r,
    owner /etc/group r,
    owner /etc/host.conf r,
    owner /etc/login.defs r,

    owner /etc/pam.d/common-account r,
    owner /etc/pam.d/common-auth r,
    owner /etc/pam.d/common-password r,
    owner /etc/pam.d/common-session r,
    owner /etc/pam.d/other r,
    owner /etc/pam.d/su r,
    owner /etc/passwd r,
    owner /etc/security/limits.conf r,
    owner /etc/security/pam_env.conf r,
    owner /etc/shadow r,
    owner /etc/shells r,
    owner /lib/security/pam_*.so m,
    owner /var/log/lastlog rwk,
    owner /var/log/wtmp rwk,
    owner /var/run/utmp rwk,
  }


  profile /usr/bin/taskset {
    #include <abstractions/base>
  }

}