#include <tunables/global>

/usr/sbin/postsrsd {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  capability setuid,
  capability setgid,
  capability sys_chroot,
  /etc/postsrsd.secret r,
  /usr/sbin/postsrsd mr,
}