# ----------------------------------------------------------------------------
#
#    Copyright (C) 2000-2014 Synology Inc. All rights reserved.
#
# ----------------------------------------------------------------------------

#include <tunables/global>

^/usr/syno/sbin/synoscgi//SYNO.Virtualization.Cluster {
	#include <abstractions/base>
	#include <abstractions/base-cgi>
	#include <abstractions.pkg/Virtualization/base>
	#include <abstractions.pkg/Virtualization/webapi>

	/usr/syno/etc/ccc/webapi.conn.info.list             k,
	/usr/syno/synoman/webapi/lib.def                    k,
	/usr/syno/synoman/webapi/SYNO.Core.System.lib       k,
	/usr/syno/synoman/webapi/SYNO.Core.Network.lib      k,
	/usr/syno/synoman/webapi/SYNO.Core.Storage.lib      k,
	/usr/syno/synoman/webapi/SYNO.CCC.lib               k,
	/usr/syno/synoman/webapi/SYNO.Entry.Request.lib     k,
	/usr/syno/etc/synoservice.d/pkgctl-Virtualization.cfg  r,
	/usr/syno/etc/synoservice.override/pkgctl-Virtualization.cfg  r,
}

^/usr/syno/sbin/synoscgi//SYNO.Virtualization.Guest {
	#include <abstractions/base>
	#include <abstractions/base-cgi>
	#include <abstractions.pkg/Virtualization/base>
	#include <abstractions.pkg/Virtualization/webapi>

	capability    chown,
	capability    fowner,

	/usr/syno/etc/ccc/webapi.conn.info.list             k,
	/usr/syno/synoman/webapi/lib.def                    k,
	/usr/syno/synoman/webapi/SYNO.Core.System.lib       k,
	/usr/syno/synoman/webapi/SYNO.Core.Network.lib      k,
	/usr/syno/synoman/webapi/SYNO.Core.Storage.lib      k,
	/usr/syno/synoman/webapi/SYNO.CCC.lib               k,
	/usr/syno/synoman/webapi/SYNO.Entry.Request.lib     k,
	/usr/syno/synoman/webapi/SYNO.Core.AppPriv.lib      k,
	/usr/syno/synoman/webapi/SYNO.DR.Node.lib           k,
	/usr/syno/etc/synoservice.d/pkgctl-Virtualization.cfg  r,
	/usr/syno/etc/synoservice.override/pkgctl-Virtualization.cfg  r,
	/usr/syno/etc/private/session/sharing.db-shm        wk,

	/volume*/**/*.ova                                  rk,
	/volume*/**/*.OVA                                  rk,
	/volume*/@*@/**                                    rk,
}

^/usr/syno/sbin/synoscgi//SYNO.Virtualization.Guest.Action {
	#include <abstractions/base>
	#include <abstractions/base-cgi>
	#include <abstractions.pkg/Virtualization/base>
	#include <abstractions.pkg/Virtualization/webapi>

	capability    chown,
	capability    mknod,
	capability    fowner,

	/usr/syno/synoman/webapi/lib.def                    k,
	/usr/syno/synoman/webapi/SYNO.Core.System.lib       k,
	/usr/syno/synoman/webapi/SYNO.CCC.lib               k,
	/usr/syno/synoman/webapi/SYNO.Entry.Request.lib     k,
	/usr/syno/synoman/webapi/SYNO.Core.Storage.lib      k,

	/volume*/**/*.ova                                 rwk,
	/volume*/@*@/**                                   rwk,
}

^/usr/syno/sbin/synoscgi//SYNO.Virtualization.Guest.P2V {
	#include <abstractions/base>
	#include <abstractions/base-cgi>
	#include <abstractions.pkg/Virtualization/base>
	#include <abstractions.pkg/Virtualization/webapi>

	capability    chown,

	/usr/syno/synoman/webapi/lib.def                    k,
	/usr/syno/synoman/webapi/SYNO.Core.AppPriv.lib      k,
	/usr/syno/synoman/webapi/SYNO.Core.ISCSI.lib	    k,

	/volume*/{,**}                                    rwk,
	/volume*/@appstore/Virtualization/bin/qemu-img     ix,
}
