#include <tunables/global>

/usr/lib/nagios/plugins/check_repomd {
  #include <abstractions/base>
  #include <abstractions/consoles>
  #include <abstractions/nameservice>

  network inet,

  /bin/bash rix,
  /bin/grep rix,
  /usr/bin/curl rix,
  /bin/cat rix,
  /bin/mktemp rix,
  /bin/rm rix,
  /usr/bin/cut rix, 
  /bin/date rix,
  /usr/lib/nagios/plugins/utils.sh r,
  /proc/sys/crypto/fips_enabled r,
  owner /tmp/check_repomd* rw,
}