module login 1.0;

require {
	type unconfined_t;
	type kernel_t;
	type postfix_master_t;
	type httpd_exec_t;
	type mysqld_t;
	type sendmail_t;
	type unconfined_service_t;
	type etc_runtime_t;
	type postfix_pickup_t;
	type ntop_port_t;
	type httpd_sys_content_t;
	type postfix_qmgr_t;
	type httpd_t;
	type sshd_t;
	class process { execmem transition };
	class tcp_socket name_connect;
	class system module_request;
	class file { execute write };
	class capability2 mac_admin;
}

#============= httpd_t ==============

#!!!! WARNING: 'etc_runtime_t' is a base type.
allow httpd_t etc_runtime_t:file write;

#!!!! This avc can be allowed using the boolean 'httpd_unified'
allow httpd_t httpd_sys_content_t:file write;

#!!!! This avc is allowed in the current policy
allow httpd_t ntop_port_t:tcp_socket name_connect;

#!!!! This avc can be allowed using the boolean 'httpd_execmem'
allow httpd_t self:process execmem;

#============= mysqld_t ==============

#!!!! This avc can be allowed using the boolean 'domain_kernel_load_modules'
allow mysqld_t kernel_t:system module_request;

#============= postfix_master_t ==============

#!!!! This avc can be allowed using the boolean 'domain_kernel_load_modules'
allow postfix_master_t kernel_t:system module_request;

#============= postfix_pickup_t ==============

#!!!! This avc can be allowed using the boolean 'domain_kernel_load_modules'
allow postfix_pickup_t kernel_t:system module_request;

#============= postfix_qmgr_t ==============

#!!!! This avc can be allowed using the boolean 'domain_kernel_load_modules'
allow postfix_qmgr_t kernel_t:system module_request;

#============= sendmail_t ==============

#!!!! This avc can be allowed using the boolean 'domain_kernel_load_modules'
allow sendmail_t kernel_t:system module_request;

#============= sshd_t ==============
allow sshd_t httpd_exec_t:file execute;

#============= unconfined_service_t ==============

#!!!! The file '/usr/bin/create_dir.sh' is mislabeled on your system.  
#!!!! Fix with $ restorecon -R -v /usr/bin/create_dir.sh
allow unconfined_service_t unconfined_t:process transition;

#============= unconfined_t ==============
allow unconfined_t self:capability2 mac_admin;