#include <tunables/global>

${CMAKE_INSTALL_PREFIX}/bin/rserver {
  

  # #################################################################
  # startup mode
  # #################################################################

  # Allow everything during startup 
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/ssl_certs>
  capability setgid,
  capability setuid,
  capability sys_resource,
  capability sys_nice,
  capability sys_ptrace,
  capability kill,
  capability chown,
  capability fowner,
  capability fsetid,
  capability dac_override,
  capability dac_read_search,
  /** rwixmkl,


  # #################################################################
  # restricted mode (transitioned into at the end of startup)  
  # #################################################################

  ^restricted {

     #include <abstractions/base>
     #include <abstractions/nameservice>
     #include <abstractions/ssl_certs>

     capability setgid,
     capability setuid,
     capability sys_resource,
     capability sys_nice,
     capability sys_ptrace,
     capability kill,
    
     @{PROC} r,
     @{PROC}/*/cmdline r,

     owner @{HOME}/** rw,
     owner /tmp/** rw,
     /tmp/rstudio-rsession/ r,
     /tmp/rstudio-rsession/** rw,
     /tmp/rstudio-rserver/** rw,
     /etc/rstudio/** r,

     ${CMAKE_INSTALL_PREFIX}/metrics/rserver-* Ux,

     ${CMAKE_INSTALL_PREFIX}/bin/rserver-* Ux,

     ${CMAKE_INSTALL_PREFIX}/bin/rsession* ux,
     ${CMAKE_INSTALL_PREFIX}/www/** r,
     ${CMAKE_INSTALL_PREFIX}/www-symbolmaps/** r,
  }   
}


