#include <tunables/global>

/volume*/@appstore/PhotoStation/bin/facerecognition {
	#include<abstractions/libsynosdk/usergroup>
	#include<abstractions/libsynoshare>
	#include <abstractions/PhotoStation/base>
	#include <abstractions/PhotoStation/photo-file-write>

	capability setuid,
	capability dac_override,
	capability dac_read_search,
	capability chown,

	/etc/shadow														r,
	/usr/syno/etc/packages/PhotoStation/settings.conf				r,
	/volume*/@appstore/PhotoStation/etc/index/libphotoindex.so		mr,
	/volume*/@appstore/PhotoStation/etc/photo_default.conf			r,
	/volume*/@tmp/photostation_face_data.root.xml.tmp				rwk,
	/var/spool/thumb_create.queue									rwk,
	/usr/syno/etc/preference/*/synoinfo.conf                 		r,
	/usr/syno/etc/private/.db.domain_user							rk,
}

/volume*/@appstore/PhotoStation/bin/photostationd {
	#include<abstractions/libsynosdk/usergroup>
	#include<abstractions/imagemagick>
	#include <abstractions/PhotoStation/base>
	#include <abstractions/PhotoStation/opencv>
	#include <abstractions/PhotoStation/photo-file-write>

	capability setuid,
	capability setgid,
	capability dac_override,
	capability sys_nice,
	capability chown,

	/etc/shadow						r,
	/usr/syno/etc/synoshare.db                                   rwk,
	/volume*/@appstore/PhotoStation/bin/facerecognition											ix,
	/volume*/@appstore/PhotoStation/bin/watermark												ix,
	/volume*/@appstore/PhotoStation/bin/photostationd											ix,
	/volume*/@appstore/PhotoStation/etc/index/libphotoindex.so									mr,
	/volume*/@appstore/PhotoStation/etc/photo_default.conf										r,
	/usr/syno/etc/packages/PhotoStation/settings.conf											r,
	/usr/syno/etc/preference/*/synoinfo.conf													r,
	/volume*/** 																				rwkl,
	/usr/syno/etc/{,**}																			rk,
	/var/spool/thumb_create.queue{,.tmp}														rwk,

}

/volume*/@appstore/PhotoStation/bin/synoblog_backup {
	#include<abstractions/libsynosdk/usergroup>
	#include <abstractions/PhotoStation/base>

	capability setgid,
	capability setuid,
	capability dac_override,
	capability dac_read_search,

	/var/spool/php/synoblog_backup.dump{,.tmp}						rwk,
	/volume*/**/synoblog_backup.dump{,.tmp}							rwk,
	/volume*/homes/**/photo/.SYNOPPSDB								rwk,
	/volume*/homes/**/photo/.SYNOPPSDB_Bak							rwk,
	/volume*/homes/**/photo/.SYNOPPSDB_Bak-journal					rwk,
	/volume*/homes/**/photo/										r,
}

/volume*/@appstore/PhotoStation/bin/synophoto_backup {
	#include<abstractions/libsynosdk/usergroup>
	#include<abstractions/libsynoshare>
	#include <abstractions/PhotoStation/base>

	capability chown,
	capability fowner,

	/etc/shadow														r,
	/var/packages/PhotoStation/INFO									r,
	/volume*/**/@photo/												r,
	/volume*/**/synophoto_backup{*.txt,.dump,.dump.tmp,.tar.gz}		rwk,
	/volume*/**/synophoto.backup									rwk,
	/volume*/**/toc_file{,.tmp}										rwk,
	/volume*/**/theme_bak/{,**}										rwk,
	/volume*/**/settings.conf.bak									rwk,
	/tmp/synophoto_backup.pid										rw,
	/usr/syno/etc/packages/PhotoStation/blog/{,**}					r,
	/usr/syno/etc/packages/PhotoStation/settings.conf{,.tmp}		rwk,
	/var/packages/PhotoStation/target/photo_scripts/cover_convert.sh	r,
}

/volume*/@appstore/PhotoStation/bin/synophoto_config {
	#include<abstractions/openssl>
	#include<abstractions/libsynosdk/usergroup>
	#include<abstractions/nameservice>
	#include <abstractions/PhotoStation/base>

	capability chown,
	capability dac_override,
	capability setgid,
	capability setuid,
	capability sys_nice,

	network    inet  dgram,
	network    inet  stream,

	/dev/crypto                             rw,
	/etc/shadow														r,
	/usr/syno/etc/extra-admin-CMS									r,
	/usr/syno/etc/synosmtp.conf										r,
	/usr/syno/etc/preference/*/synoinfo.conf					r,
	/usr/syno/etc/packages/PhotoStation/settings.conf{,.*}			rwk,
	/usr/syno/synoman/webapi/SYNO.Core.Notification.lib				rwk,
	/usr/syno/synoman/webapi/lib.def                             	rwk,
	/volume*/@appstore/PhotoStation/ui/config						rwk,
	/var/spool/webapi/{,**}											rwk,
}

/volume*/@appstore/PhotoStation/bin/synophoto_config_root {
	#include<abstractions/openssl>
	#include<abstractions/nameservice>
	#include <abstractions/PhotoStation/base>

	capability chown,
	capability dac_override,
	capability setgid,
	capability setuid,
	capability sys_nice,
	capability fowner,

	network    inet  dgram,
	network    inet  stream,

	/dev/crypto                             rw,
	/etc/{,**}								r,
	/usr/syno/etc/{,**}												r,
	/usr/syno/synoman/webapi/SYNO.Core.Notification.lib				rwk,
	/usr/syno/synoman/webapi/lib.def                             	rwk,
	/volume*/@appstore/PhotoStation/ui/config						rwk,
	/var/spool/webapi/{,**}											rwk,
	/volume*/{,usbshare*/@sharebin/}homes/**						rwk,
	/usr/syno/etc/packages/PhotoStation/{,**}						rwk,
	/usr/syno/etc/preference/**										rwk,
}

/volume*/@appstore/PhotoStation/bin/synophoto_dsm_user {
	#include<abstractions/authentication>
	#include<abstractions/nameservice>
	#include<abstractions/libsynoshare>
	#include<abstractions/libsynosdk/usergroup>
	#include<abstractions/autoblock>
	#include <abstractions/PhotoStation/base>
	#include<abstractions/app-privilege>
	#include<abstractions/synopkg>
	#include<abstractions/synoservice>

	#include<abstractions/libsynocgi>
	#include<abstractions/libsynosmartblock>

	capability setgid,
	capability fowner,
	capability chown,
	capability dac_override,
	capability dac_read_search,
	capability block_suspend,

	/lib/libexiv2.so.9												mr,
	/lib/libsynosdk.so.5                                        	mr,
	/lib/libxml2.so.2.9.1                                        	r,
	/usr/syno/etc/extra-admin-CMS									r,
	/var/spool/syno_indexing_queue									rwk,
	/volume*/@appstore/PhotoStation/bin/synophoto_extract_preview   ix,
	/volume*/**														rwk,
	/usr/syno/etc/packages/PhotoStation/settings.conf				r,
	/etc/															r,
	/etc/**															r,
	/usr/syno/etc/													r,
	/usr/syno/etc/**												r,
	/dev/tty														w,
	/var/packages/SynologyMoments/scripts/start-stop-status			rix,
	/var/packages/SynologyMoments/scripts/common					r,
}

/volume*/@appstore/PhotoStation/bin/synophoto_external_access {
	#include<abstractions/quickconnect>
	#include <abstractions/PhotoStation/base>

	capability setgid,
	capability setuid,
	capability chown,
	capability sys_nice,
	capability dac_override,
	capability dac_read_search,

	/etc/ddns.conf													r,
	/usr/syno/synoman/webapi/SYNO.Core.QuickConnect.lib				rwk,
	/usr/syno/synoman/webapi/SYNO.Core.DDNS.lib						rwk,
	/usr/syno/synoman/webapi/lib.def								rwk,
	/usr/syno/etc/packages/PhotoStation/settings.conf				r,
	/var/spool/webapi/{,**}											rwk,
	/usr/syno/etc/private/session/sharing.db						rwk,
}

/volume*/@appstore/PhotoStation/bin/synophoto_extract_preview {
	#include<abstractions/libsynosdk/usergroup>
	#include <abstractions/PhotoStation/base>
	#include <abstractions/PhotoStation/photo-ea-write>
	#include <abstractions/PhotoStation/all-file-read>

	capability setgid,
	capability setuid,
	capability fowner,
	capability dac_override,
	capability dac_read_search,

	/etc/group																r,
	/etc/nsswitch.conf														r,
	/etc/shadow																r,
	/etc/passwd																r,
}

/volume*/@appstore/PhotoStation/bin/synophoto_music {
	#include <abstractions/PhotoStation/base>
	#include <abstractions/PhotoStation/mp3-ea-write>
}

/volume*/@appstore/PhotoStation/bin/synophoto_sdk_share_set {
	#include<abstractions/libsynoshare>
	#include <abstractions/PhotoStation/base>

	capability setuid,
	capability fowner,
	capability chown,
	capability dac_override,
	capability dac_read_search,

	/usr/local/etc/php70/conf.d/SYNO.SDS.PhotoStation.ini{,.*}		rwk,
	/volume*/@appstore/PhotoStation/etc/SYNO.SDS.PhotoStation.ini{,.*}		rwk,
	/volume*/@tmp/													w,
	/volume*/@tmp/photo_upload_tmp_dir/								w,
}

/volume*/@appstore/PhotoStation/bin/synophoto_sns_utils {
	#include<abstractions/nameservice>
	#include<abstractions/curl>
	#include<abstractions/openssl>
	#include <abstractions/PhotoStation/base>
	#include <abstractions/PhotoStation/photo-file-read>

	/volume*/@appstore/PhotoStation/photo/facebook/**				rwk,
	/volume*/@appstore/PhotoStation/photo/vendor/**					r,
	/volume*/@appstore/PhotoStation/photo/include/SYNOPhotoEA.php	r,
}

/volume*/@appstore/PhotoStation/bin/synophotoio {
	#include<abstractions/webfm/index>
	#include<abstractions/libsynoshare>
	#include<abstractions/libsynosdk/usergroup>
	#include <abstractions/PhotoStation/base>

	capability chown,
	capability setgid,
	capability setuid,
	capability fowner,
	capability dac_override,

	/volume*/**														rw,
	/etc/shadow                                                  r,
	/usr/syno/etc/{,**}												r,
	/volume*/.db.domain_user_full*									rk,
}

/volume*/@appstore/PhotoStation/bin/watermark {
	#include<abstractions/imagemagick>
	#include <abstractions/PhotoStation/base>
	#include <abstractions/PhotoStation/photo-file-write>
	#include <abstractions/PhotoStation/watermark-ea-write>

	/volume*/@appstore/PhotoStation/bin/photostationd      ix,
}

/volume*/@appstore/PhotoStation/bin/synophoto_watermark_util {
	#include<abstractions/libsynosdk/usergroup>
	#include <abstractions/PhotoStation/base>
	#include <abstractions/PhotoStation/all-file-read>
	#include <abstractions/PhotoStation/photo-file-write>
	#include <abstractions/PhotoStation/watermark-ea-write>

	capability fowner,
	capability chown,
	capability dac_override,
	capability dac_read_search,
}

/volume*/@appstore/PhotoStation/bin/synophoto_acl {
	#include <abstractions/authentication>
	#include <abstractions/nameservice>
	#include <abstractions/share>
	#include <abstractions/libsynoshare>
	#include <abstractions/SDKPlugin>
	#include <abstractions/PhotoStation/base>
	#include <abstractions/PhotoStation/photo-file-write>
	#include <abstractions/PhotoStation/all-file-read>

	capability setgid,
	capability fowner,
	capability chown,
	capability dac_override,
	capability dac_read_search,
	capability sys_resource,

	/usr/syno/etc/{,**}												r,
	/etc/{,**}														r,
	/volume*/.db.domain_user_full*									rk,
	/usr/syno/etc/packages/PhotoStation/settings.conf*				rwk,
	/volume*/@appstore/PhotoStation/photo_scripts/sql/acl_trigger.sh rix,
	/volume*/@appstore/PhotoStation/photo_scripts/{,**}				r,
	/dev/tty                                                     rw,
	/volume*/@eaDir/{,**}										rwk,
	/proc/*/attr/exec											w,
	/usr/local/libexec/share_set/*								ix,
}
