policy_module(chrony_dhcp_dispatcher, 1.0.0)

########################################
# Let chronyd reply to the chronyc that our NetworkManager dispatcher script
# runs. files/etc/NetworkManager/dispatcher.d/10-chrony-dhcp-ntp loads DHCP
# option-42 NTP servers with `chronyc reload sources`. That chronyc runs in the
# confined custom-dispatcher domain (NetworkManager_dispatcher_custom_t), so its
# reply socket is labeled with that domain, and the shipped policy has no rule
# for chronyd_t -> that socket. Result (enforcing): chronyd processes the reload
# but its ack `sendto` is DENIED — chronyc reports failure and the AVC floods the
# SIEM. This one allow closes it. Minimal + auditable; justified in
# docs/stig-deviations.md. If a follow-on AVC appears on the bench, extend here.
########################################

require {
    type chronyd_t;
    type NetworkManager_dispatcher_custom_t;
    class unix_dgram_socket sendto;
}

allow chronyd_t NetworkManager_dispatcher_custom_t:unix_dgram_socket sendto;