# Last Modified: Sun Aug 18 22:54:57 2013
# Assumes fwknopd was built with:
#    './configure --prefix=/usr --sysconfdir=/etc --localstatedir=/run'
include <tunables/global>

/usr/sbin/fwknopd flags=(complain) {
  include <abstractions/base>

  capability ipc_lock,
  capability net_admin,
  capability net_raw,

  network inet raw,
  network inet dgram,
  network inet6 dgram,
  network packet raw,
  network packet dgram,

  /bin/dash rix,
  /bin/bash rix,
  /etc/fwknop/access.conf r,
  /etc/fwknop/fwknopd.conf r,
  /etc/host.conf r,
  /etc/nsswitch.conf r,
  /etc/passwd r,
  /etc/protocols r,
  /etc/resolv.conf r,
  /etc/services r,
  @{PROC}/@{pid}/net/ip_tables_names r,
  /root/.gnupg/* rwkl,
  /run/fwknop/ rw,
  /run/fwknop/* rwk,
  /run/resolvconf/resolv.conf r,
  /run/xtables.lock rwk,
  /sbin/ipset rix,
  /sbin/xtables-legacy-multi rix,
  /sbin/xtables-multi rix,
  /usr/bin/gpg rix,
  /usr/sbin/fwknopd mr,
  /usr/sbin/ipset rix,
  /usr/sbin/xtables-legacy-multi rix,
  /usr/sbin/xtables-nft-multi rix,
  /var/cache/nscd/passwd r,

}