sepolicy/weave.te

# weaved.
type weaved, domain;
type weaved_exec, exec_type, file_type;
type weaved_data_file, file_type, data_file_type;
type weave_prop, property_type;

brillo_domain(weaved)
net_domain(weaved)

# Allow crash_reporter access to core dump files.
allow_crash_reporter(weaved)

# Allow weaved to talk to power manager in order to be able to reboot system.
allow_power_management(weaved)

# Allow setting weave properties.
set_prop(weaved, weave_prop)

allow weaved weave_service:service_manager { add find };

allow weaved weaved_data_file:dir w_dir_perms;
allow weaved weaved_data_file:file create_file_perms;

# Allow talking to webservd.
use_webservd(weaved)

allow weaved system_file:dir r_file_perms;

# Allow reading os-release.d properties.
r_dir_file(weaved, os_release_file);