# ----------------------------------------------------------------------------
#
#    Copyright (C) 2000-2015 Synology Inc. All rights reserved.
#
# ----------------------------------------------------------------------------

#include <tunables/global>

^/usr/syno/synoman/webapi/entry.cgi//SYNO.TPS.Event {
	#include <abstractions/base>
	#include <abstractions/base-cgi>

	capability chown,
	/etc/sysconfig/clock															r,
	/var/db/geoip-database/GeoLiteCity.dat                                              r,
	/var/db/geoip-database/GeoLite2-City.mmdb											r,
	/volume*/@appstore/ThreatPrevention/lib/libsynotps.so.*							mr,
	/volume*/@appstore/ThreatPrevention/webapi/event/SYNO.TPS.Event.so						mr,
	/usr/syno/etc/packages/ThreatPrevention/udc_counter*									rwk,
	/usr/syno/etc/packages/ThreatPrevention/udc_event.json							rwk,
}

^/usr/syno/synoman/webapi/entry.cgi//SYNO.TPS.Overview {
	#include <abstractions/base>
	#include <abstractions/base-cgi>

	/var/db/geoip-database/GeoLite2-City.mmdb											r,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata/classification.config		rwk,
	/volume*/@appstore/ThreatPrevention/lib/libGeoIP.so.1*								mr,
	/volume*/@appstore/ThreatPrevention/lib/libsynotps.so.*							mr,
	/volume*/@appstore/ThreatPrevention/webapi/overview/SYNO.TPS.Overview.so					mr,
}

^/usr/syno/synoman/webapi/entry.cgi//SYNO.TPS.Signature.Rule {
	#include <abstractions/base>
	#include <abstractions/base-cgi>

	capability chown,
	network    inet  raw,
	/proc/syno_ctf_enable														rwk,
	/usr/syno/etc/wan.conf														r,
	/usr/syno/etc/secondarywan.conf												r,
	/usr/syno/etc.defaults/iptables_chain_list											r,
	/usr/sbin/pppoe-status																rix,
	/etc/ppp/																			r,
	/etc/ppp/syno_pppoe.conf															r,
	/etc/ppp/pppoe_*.conf																r,
	/etc/ppp/options_*																	r,
	/etc/dhcpd/{,*}												r,
	/etc/dhcpd/dhcpd.conf											rwk,
	/etc/dhcpd/dhcpd.info											rwk,
	/etc/default_offload/*_offload.conf								                r,
	/usr/syno/etc/packages/ThreatPrevention/var.conf*								rwk,
	/usr/syno/etc/packages/ThreatPrevention/sensor.info*								rwk,
	/usr/syno/etc/packages/ThreatPrevention/sensor.conf*								rwk,
	/usr/syno/etc/packages/ThreatPrevention/ruleset.conf*							rwk,
	/usr/syno/etc/packages/ThreatPrevention/signature.conf*							rwk,
	/usr/syno/etc/packages/ThreatPrevention/udc_counter*									rwk,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata/rules/{,*}				rwk,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata/signatures/{,*}			rwk,
	/volume*/@appstore/ThreatPrevention/etc/suricata/suricata.yaml*						rwk,
	/volume*/@appstore/ThreatPrevention/lib/libsynotps.so.*							mr,
	/volume*/@appstore/ThreatPrevention/webapi/signature/SYNO.TPS.Signature.so				mr,
	/proc/sys/net/bridge/syno-bridge-nf-cond-call-netfilter-threat-prevention			rwk,
}

^/usr/syno/synoman/webapi/entry.cgi//SYNO.TPS.Signature {
	#include <abstractions/base>
	#include <abstractions/base-cgi>

	capability chown,
	network    inet  raw,
	/proc/syno_ctf_enable														rwk,
	/etc/ppp/																	r,
	/etc/ppp/syno_pppoe.conf													r,
	/etc/ppp/pppoe_*.conf														r,
	/etc/ppp/options_*															r,
	/etc/dhcpd/{,*}												r,
	/etc/dhcpd/dhcpd.conf											rwk,
	/etc/dhcpd/dhcpd.info											rwk,
	/usr/syno/etc/wan.conf														r,
	/usr/syno/etc/secondarywan.conf												r,
	/usr/syno/etc.defaults/iptables_chain_list									r,
	/usr/sbin/pppoe-status														rix,
	/volume*/@appstore/ThreatPrevention/etc/suricata/suricata.yaml*						rwk,
	/volume*/@appstore/ThreatPrevention/lib/libsynotps.so.*							mr,
	/volume*/@appstore/ThreatPrevention/webapi/signature/SYNO.TPS.Signature.so		mr,
	/volume*/@appstore/ThreatPrevention/etc/rules/old.rules.tar.gz						r,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata/rules/{,*}					rwk,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata/signatures/{,*}				rwk,
	/volume*/@appstore/ThreatPrevention/etc/rules/ruleset.conf							rw,
	/volume*/@appstore/ThreatPrevention/etc/rules/signature.conf							rw,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata/classification.config		rwk,
	/volume*/@db/var/db/synotps-database/custom_signature.json							rk,
	/usr/syno/etc/packages/ThreatPrevention/signature.conf*								rwk,
	/usr/syno/etc/packages/ThreatPrevention/ruleset.conf*								rwk,
	/usr/syno/etc/packages/ThreatPrevention/sensor.conf*									rwk,
	/usr/syno/etc/packages/ThreatPrevention/sensor.info*									rwk,
	/usr/syno/etc/packages/ThreatPrevention/udc_counter*									rwk,
	/usr/syno/etc/packages/ThreatPrevention/var.conf*						rwk,
	/etc/default_offload/*_offload.conf													r,
	/proc/sys/net/bridge/syno-bridge-nf-cond-call-netfilter-threat-prevention			rwk,
}

^/usr/syno/synoman/webapi/entry.cgi//SYNO.TPS.Sensor {
	#include <abstractions/base>
	#include <abstractions/base-cgi>
	#include <abstractions/wget>

	capability chown,
	network inet raw,
	/sys/kernel/debug/ecm/ecm_db/defunct_all					rwk,
	/sys/kernel/debug/ecm/ecm_nss_ipv4/stop						w,
	/sys/kernel/debug/ecm/ecm_nss_ipv6/stop						w,
	/sys/kernel/debug/ecm/front_end_ipv4_stop					w,
	/sys/kernel/debug/ecm/front_end_ipv6_stop					w,

	/sbin/initctl												ix,
	/sbin/ip																			ix,
	/bin/tar																			ix,
	/etc/dhcpd/{,*}												r,
	/etc/dhcpd/dhcpd.conf											rwk,
	/etc/dhcpd/dhcpd.info											rwk,
	/etc/dhcpc/dhcpcd-*.info										r,
	/etc/rc.network_routing											rix,
	/etc/sysconfig/network											r,
	/etc/sysconfig/networking/ifcfg-*									rwk,
	/proc/sys/net/ipv6/conf/*/disable_ipv6									rwk,
	/proc/syno_ctf_enable										rwk,
	/usr/sbin/ifconfig											rix,
	/usr/sbin/pppoe-status										rix,
	/etc/ppp/													r,
	/etc/ppp/pppoe_*.conf										r,
	/etc/ppp/options_*											r,
	/etc/ppp/syno_pppoe.conf									r,
	/etc/default_offload/*_offload.conf								                r,
	/usr/syno/etc/packages/ThreatPrevention/**										rwk,
	/usr/syno/etc/packages/ThreatPrevention/sensor.conf*							rwk,
	/usr/syno/etc/packages/ThreatPrevention/sensor.info*							rwk,
	/usr/syno/etc/packages/ThreatPrevention/var.conf*								rwk,
	/usr/syno/etc.defaults/iptables_chain_list								r,
	/usr/syno/{etc,etc.defaults}/synonet/{,**}								r,
	/usr/syno/etc/wan.conf													r,
	/usr/syno/etc/secondarywan.conf												r,
	/usr/syno/sbin/brctl											rix,
	/usr/syno/sbin/synonetdtool										rix,
	/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_CA.crt						r,
	/volume*/@appstore/ThreatPrevention/etc/rules/*										rw,
	/volume*/@appstore/ThreatPrevention/etc/suricata/suricata.yaml*						rwk,
	/volume*/@appstore/ThreatPrevention/lib/libsynotps.so.*							mr,
	/volume*/@appstore/ThreatPrevention/webapi/sensor/SYNO.TPS.Sensor.so					mr,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata/*						rwk,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata/rules/*					rwk,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata/signatures/*				rwk,
	/volume*/@db/var/db/synotps-database/custom_signature.json							rk,
	/proc/sys/net/bridge/syno-bridge-nf-cond-call-netfilter-threat-prevention			rwk,
}

^/usr/syno/synoman/webapi/entry.cgi//SYNO.TPS.Sensor.Variables {
	#include <abstractions/base>
	#include <abstractions/base-cgi>

	/sbin/initctl																			ix,
	/usr/syno/etc/packages/ThreatPrevention/var.conf*								rwk,
	/volume*/@appstore/ThreatPrevention/etc/suricata/suricata.yaml*						rwk,
	/volume*/@appstore/ThreatPrevention/lib/libsynotps.so.*							mr,
	/volume*/@appstore/ThreatPrevention/webapi/sensor/SYNO.TPS.Sensor.so					mr,
}

^/usr/syno/synoman/webapi/entry.cgi//SYNO.TPS.Settings.Update.Schedule {
	#include <abstractions/base>
	#include <abstractions/base-cgi>

	capability chown,
	/etc/crontab*												rwk,
	/usr/syno/etc/packages/ThreatPrevention/updater.conf*							rwk,
	/volume*/@appstore/ThreatPrevention/lib/libsynotps.so.*							mr,
	/volume*/@appstore/ThreatPrevention/webapi/settings/SYNO.TPS.Settings.so					mr,
}

^/usr/syno/synoman/webapi/entry.cgi//SYNO.TPS.Settings.Update.Source {
	#include <abstractions/base>
	#include <abstractions/base-cgi>

	capability chown,
	/etc/crontab*												rwk,
	/usr/syno/etc/packages/ThreatPrevention/updater.conf*							rwk,
	/volume*/@appstore/ThreatPrevention/lib/libsynotps.so.*							mr,
	/volume*/@appstore/ThreatPrevention/webapi/settings/SYNO.TPS.Settings.so					mr,
}

^/usr/syno/synoman/webapi/entry.cgi//SYNO.TPS.Settings.Update {
	#include <abstractions/base>
	#include <abstractions/base-cgi>
	#include <abstractions/wget>

	capability chown,
	network    inet  raw,
	/proc/syno_ctf_enable														rwk,
	/etc/default_offload/*_offload.conf											r,
	/etc/dhcpd/{,*}												r,
	/etc/dhcpd/dhcpd.conf											rwk,
	/etc/dhcpd/dhcpd.info											rwk,
	/etc/ppp/syno_pppoe.conf													r,
	/etc/ppp/pppoe_*.conf														r,
	/etc/ppp/options_*															r,
	/etc/ppp/																	r,
	/sbin/ip                                                                                                ix,
	/usr/sbin/pppoe-status														rix,
	/usr/syno/etc/wan.conf														r,
	/usr/syno/etc/secondarywan.conf												r,
	/usr/syno/etc.defaults/iptables_chain_list									r,
	/usr/syno/{etc,etc.defaults}/synonet/{,**}									r,
	/usr/sbin/pppoe-status														rix,
	/usr/syno/etc/packages/ThreatPrevention/**										rwk,
	/usr/syno/etc/packages/ThreatPrevention/updater.conf*							rwk,
	/usr/syno/etc/packages/ThreatPrevention/updater.info*							rwk,
	/usr/syno/etc/packages/ThreatPrevention/signature.conf*							rwk,
	/usr/syno/etc/packages/ThreatPrevention/sensor.info*								rwk,
	/usr/syno/etc/packages/ThreatPrevention/build_signature_database.conf			rwk,
	/usr/syno/etc/packages/ThreatPrevention/var.conf*								rwk,
	/volume*/@appstore/ThreatPrevention/etc/rules/*									rwk,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata/							rwk,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata/**						rwk,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata.bak/						rwk,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata.bak/**					rwk,
	/volume*/@appstore/ThreatPrevention/etc/suricata/suricata.yaml*					rwk,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata/classification.config	rwk,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata/reference.config			rwk,
	/volume*/@appstore/ThreatPrevention/lib/libsynotps.so.*							mr,
	/volume*/@appstore/ThreatPrevention/webapi/settings/SYNO.TPS.Settings.so					mr,
	/volume*/@appstore/Perl/lib/perl5/core_perl/**								mr,
	/volume*/@appstore/Perl/usr/share/perl5/core_perl/**							r,
	/volume*/@db/var/db/synotps-database/custom_signature.json							rk,
	/proc/sys/net/bridge/syno-bridge-nf-cond-call-netfilter-threat-prevention			rwk,
}

^/usr/syno/synoman/webapi/entry.cgi//SYNO.TPS.Settings.Update.Notification {
	#include <abstractions/base>
	#include <abstractions/base-cgi>

	/usr/syno/etc/packages/ThreatPrevention/notification.conf				rwk,
	/volume*/@appstore/ThreatPrevention/webapi/notification/SYNO.TPS.Notification.so		mr,
	/volume*/@appstore/ThreatPrevention/lib/libsynotps.so.*					mr,
}

^/usr/syno/synoman/webapi/entry.cgi//SYNO.TPS.Notification.Filter {
	#include <abstractions/base>
	#include <abstractions/base-cgi>
	#include <abstractions/notification>

	/usr/syno/etc/packages/ThreatPrevention/notification.conf				rwk,
	/usr/syno/etc/packages/ThreatPrevention/notification_filter.conf*		rwk,
	/volume*/@appstore/ThreatPrevention/webapi/notification/SYNO.TPS.Notification.so		mr,
	/volume*/@appstore/ThreatPrevention/lib/libsynotps.so.*					mr,
	/volume*/@appstore/ThreatPrevention/etc/rules/suricata/classification.config	rwk,
	/volume*/@db/var/db/synotps-database/custom_signature.json						rk,
}

^/usr/syno/synoman/webapi/entry.cgi//SYNO.TPS.Backup {
	#include <abstractions/base>
	#include <abstractions/base-cgi>

	network		inet	raw,
	capability	fowner,
	capability	chown,
	/bin/tar																			ix,
	/etc/dhcpd/{,*}																		r,
	/etc/dhcpd/dhcpd.conf																rwk,
	/etc/dhcpd/dhcpd.info																rwk,
	/volume*/@tmp/*																		rwk,
	/volume*/*/@tmp/*																	rwk,
	/var/packages/ThreatPrevention/etc/*												rw,
	/usr/syno/etc/wan.conf																r,
	/usr/syno/etc/secondarywan.conf														r,
	/usr/syno/sbin/brctl																rix,
	/usr/syno/etc.defaults/mimetypes.txt												r,
	/usr/syno/etc.defaults/iptables_chain_list											r,
	/usr/syno/{etc,etc.defaults}/synonet/{,**}											r,
	/usr/syno/etc/packages/ThreatPrevention/**											rwk,
	/volume*/@appstore/ThreatPrevention/webapi/backup_restore/SYNO.TPS.Backup.so		mr,
	/volume*/@appstore/ThreatPrevention/lib/libsynotps.so.*								mr,
	/volume*/@appstore/ThreatPrevention/etc/suricata/suricata.yaml*						rwk,
	/volume*/@appstore/ThreatPrevention/etc/rules/**									rwk,
	/volume*/@db/var/db/synotps-database/custom_signature.json							rk,
	/etc/ppp/																			r,
	/etc/ppp/syno_pppoe.conf															r,
	/etc/ppp/pppoe_*.conf																r,
	/etc/ppp/options_*																	r,
	/etc/default_offload/*_offload.conf													r,
	/usr/sbin/pppoe-status																rix,
	/sbin/ip																			ix,
	/proc/sys/net/bridge/syno-bridge-nf-cond-call-netfilter-threat-prevention			rwk,
}
