type cros_cryptohomed, chromeos_domain, domain;

permissive cros_cryptohomed;

domain_auto_trans(cros_init_scripts, cros_cryptohomed_exec, cros_cryptohomed);

allow domain cros_cryptohomed:key search;

log_writer(cros_cryptohomed);
uma_writer(cros_cryptohomed);

filetrans_pattern(cros_cryptohomed, cros_home, cros_home_shadow, dir, ".shadow");
filetrans_pattern(cros_cryptohomed, cros_home_shadow, cros_home_shadow_low_entropy_creds, dir, "low_entropy_creds");
filetrans_pattern(cros_cryptohomed, cros_home_shadow, cros_home_shadow_uid, dir);
filetrans_pattern(cros_cryptohomed, cros_home_shadow_uid, cros_home_shadow_uid_root, dir, "root");
filetrans_pattern(cros_cryptohomed, cros_home_shadow_uid, cros_home_shadow_uid_user, dir, "user");
filetrans_pattern(cros_cryptohomed, cros_home_shadow_uid_user, cros_downloads_file, dir, "Downloads");
filetrans_pattern(cros_cryptohomed, cros_home_shadow_uid_user, cros_downloads_file, dir, "MyFiles");
filetrans_pattern(cros_cryptohomed, cros_home_shadow_uid_root, cros_home_shadow_uid_root_chaps, dir, "chaps");
filetrans_pattern(cros_cryptohomed, cros_home_shadow_uid_root, cros_home_shadow_uid_root_usb_bouncer, dir, "usb_bouncer");
filetrans_pattern(cros_cryptohomed, cros_home_shadow_uid_root, cros_home_shadow_uid_root_authpolicyd, dir, "authpolicyd");

# Ephemeral mount should have the same treatment as normal mount.
filetrans_pattern({cros_init_scripts cros_cryptohomed}, cros_run, cros_run_cryptohome, dir, "cryptohome");
filetrans_pattern({cros_init_scripts cros_cryptohomed}, cros_run_cryptohome, cros_ephemeral_mount, dir, "ephemeral_mount");

# Note that this transition is currently ineffective as the ephemeral mount is a new filesystem.
# Setting the new ephemeral mount to cros_home_shadow_uid is done by cryptohome at the moment.
filetrans_pattern({cros_init_scripts cros_cryptohomed}, cros_ephemeral_mount, cros_home_shadow_uid, dir);

dev_only(
auditallow domain cros_home_shadow_uid_root:dir create;
auditallow domain cros_home_shadow_uid_user:dir create;
)