ListenFIFO=%t/my_minecraft_server.stdin

PartOf=my_minecraft_server.service

[Install]
WantedBy=multi-user.target

$ echo "stop" > /run/my_minecraft_server.stdin

$ sudo systemctl status my_minecraft_server.socket
Unit my_minecraft_server.socket could not be found

$ sudo systemctl enable my_minecraft_server.socket
Failed to enable unit: Unit file my_minecraft_server.socket does not exist

$ systemctl start my_minecraft_service.socket
$ echo "start" > /run/my_minecraft_server.stdin

Sockets=my_minecraft_server.socket

java -Xmx1024M -Xms1024M -jar minecraft_server.1.20.6.jar nogui

$ sudo systemctl enable /home/user/services/my_minecraft_server.socket
Created symlink /etc/systemd/system/my_minecraft_server.socket → /home/user/services/my_minecraft_server.socket.
The unit files have no installation config (WantedBy=, RequiredBy=, Also=,
Alias= settings in the [Install] section, and DefaultInstance= for template
units). This means they are not meant to be enabled or disabled using systemctl.

Possible reasons for having this kind of units are:
• A unit may be statically enabled by being symlinked from another unit's
  .wants/ or .requires/ directory.
• A unit's purpose may be to act as a helper for some other unit which has
  a requirement dependency on it.
• A unit may be started when needed via activation (socket, path, timer,
  D-Bus, udev, scripted systemctl call, ...).
• In case of template units, the unit is meant to be enabled with some

[Install]
WantedBy=multi-user.target

$ sudo systemctl status my_minecraft_server.socket
× my_minecraft_server.socket
     Loaded: loaded (/etc/systemd/system/my_minecraft_server.socket; enabled; preset: disabled)
     Active: failed (Result: resources)
   Triggers: ● my_minecraft_server.service
     Listen: /run/my_minecraft_server.stdin (FIFO)

May 06 17:20:47 localhost.localdomain systemd[1]: my_minecraft_server.socket: Failed with result 'resources'.
May 06 17:20:47 localhost.localdomain systemd[1]: Failed to listen on my_minecraft_server.socket.
May 06 17:21:47 localhost.localdomain systemd[1]: my_minecraft_server.socket: Failed to open FIFO /run/my_minecraft_server.stdin: Permission denied
May 06 17:21:47 localhost.localdomain systemd[1]: my_minecraft_server.socket: Failed to listen on sockets: Permission denied
May 06 17:21:47 localhost.localdomain systemd[1]: my_minecraft_server.socket: Failed with result 'resources'.
May 06 17:21:47 localhost.localdomain systemd[1]: Failed to listen on my_minecraft_server.socket.
May 06 17:23:56 localhost.localdomain systemd[1]: my_minecraft_server.socket: Failed to open FIFO /run/my_minecraft_server.stdin: Permission denied
May 06 17:23:56 localhost.localdomain systemd[1]: my_minecraft_server.socket: Failed to listen on sockets: Permission denied
May 06 17:23:56 localhost.localdomain systemd[1]: my_minecraft_server.socket: Failed with result 'resources'.
May 06 17:23:56 localhost.localdomain systemd[1]: Failed to listen on my_minecraft_server.socket.

$ stat /run/my_minecraft_server.stdin
  File: /run/my_minecraft_server.stdin
  Size: 0               Blocks: 0          IO Block: 4096   fifo
Device: 17h/23d Inode: 1283        Links: 1
Access: (0777/prwxrwxrwx)  Uid: (    0/    root)   Gid: (    0/    root)
Context: system_u:object_r:var_run_t:s0
Access: 2024-05-06 17:19:21.874239640 +0800
Modify: 2024-05-06 17:19:21.874239640 +0800
Change: 2024-05-06 17:21:23.616796067 +0800
 Birth: 2024-05-06 17:19:21.874239640 +0800

module my_policy 1.0;

require {
        type user_home_t;
        type init_tmp_t;
        type httpd_t;
        type init_t;
        type var_run_t;
        type unreserved_port_t;
        type http_port_t;
        type user_tmp_t; 
        class file { append create execute execute_no_trans getattr ioctl map open read rename write };
        class lnk_file { read };
        class fifo_file { ioctl read write };
        class process execmem;
        class tcp_socket name_connect;
}

#============= httpd_t ==============

#!!!! This avc can be allowed using one of the these booleans:
#     httpd_can_network_connect, nis_enabled
allow httpd_t unreserved_port_t:tcp_socket name_connect;

#!!!! This avc can be allowed using the boolean 'httpd_read_user_content'
allow httpd_t user_home_t:file { open read };

#!!!! This avc can be allowed using the boolean 'httpd_read_user_content'
allow httpd_t user_tmp_t:file open;

#============= init_t ==============
allow init_t init_tmp_t:file execute;
allow init_t self:process execmem;
allow init_t user_home_t:file { append create execute execute_no_trans ioctl map open read rename write };

#!!!! This avc can be allowed using the boolean 'nis_enabled'
allow init_t http_port_t:tcp_socket name_connect;

#!!!! This avc can be allowed using the boolean 'domain_can_mmap_files'
allow init_t user_home_t:file map;
allow init_t user_home_t:lnk_file read;
allow init_t user_tmp_t:file { create map open write }; 
allow init_t var_run_t:fifo_file { ioctl read write };

checkmodule -M -m -o my_policy.mod my_policy.te
semodule_package -o my_policy.pp -m my_policy.mod
sudo semodule -i my_policy.pp