#include <tunables/global>

^/usr/syno/sbin/synoscgi//SYNO.DNSServer.DLZ {
    #include <abstractions/base>
    #include <abstractions/base-cgi>
    #include <abstractions/webapi-DSM5>

    capability  setgid,
    capability  setuid,
    capability  chown,
    capability  fowner,

    /volume*/@appstore/DNSServer/**                              mrwlk,
    /var/packages/DNSServer/**                                   mrwlk,

    /var/packages/ActiveDirectoryServer/target/**                    mrwlk,
    /volume*/@appstore/ActiveDirectoryServer/**                      mrwlk,
    /var/packages/DirectoryServerForWindowsDomain/target/**          mrwlk,
    /volume*/@appstore/DirectoryServerForWindowsDomain/**            mrwlk,
    /lib/**                      r,
    /usr/lib/**                      r,

    mount /var/packages/ActiveDirectoryServer/target/private,
    mount /volume*/@appstore/ActiveDirectoryServer/private,
    mount /var/packages/DirectoryServerForWindowsDomain/target/private,
    mount /volume*/@appstore/DirectoryServerForWindowsDomain/private,
    mount /usr/lib,
    mount /lib,
    mount -> /var/packages/DNSServer/target/named/etc/samba/**,
    mount -> /volume*/@appstore/DNSServer/named/etc/samba/**,
    mount -> /var/packages/DNSServer/target/named/usr/**,
    mount -> /volume*/@appstore/DNSServer/named/usr/**,
    mount -> /var/packages/DNSServer/target/named/lib/**,
    mount -> /volume*/@appstore/DNSServer/named/lib/**,

    umount,
}

/volume*/@appstore/DNSServer/bin/named {
	#include<abstractions/base>
	#include<abstractions/base-cgi>

	/volume*/@appstore/DNSServer/named/**                     rwixk,

	capability chown,
	capability fowner,
	capability setgid,
	capability sys_chroot,
	capability dac_read_search,
	capability sys_resource,
	capability net_bind_service,
}