{
    program: {
        binary: "bin/driver_manager",
        args: [ "--log-to-debuglog" ],
    },
    use: [
        { runner: "elf" },
        {
            directory: "/bin",
            rights: [ "rx*" ],
        },
        {
            directory: "/blob",
            rights: [ "rw*" ],
        },
        {
            directory: "/boot",
            rights: [ "rx*" ],
        },
        {
            directory: "/hub",
            rights: [ "rw*" ],
        },
        {
            directory: "/minfs",
            as: "/data",
            rights: [ "rw*" ],
        },
        {
            directory: "/pkgfs",
            rights: [ "rx*" ],
        },
        {
            directory: "/system",
            rights: [ "rx*" ],
        },

        // NOTE: /tmp needs admin rights because the bringup bots invoke a shell
        // script via zircon.system.autorun that mounts a volume under /tmp to
        // exfiltrate test results.
        {
            directory: "/tmp",
            rights: [
                "admin",
                "rw*",
            ],
        },

        // TODO: this directory is unused and can likely be deleted
        {
            directory: "/install",
            rights: [ "rw*" ],
        },

        // TODO: this volume directory is only used by the paver lib in netsvc under
        // driver_manager. The paver lib could create its own memfs instead, so
        // this should eventually be removed.
        {
            directory: "/volume",
            rights: [
                "admin",
                "rw*",
            ],
        },
        {
            directory: "/system-delayed",
            rights: [ "rx*" ],
        },
        {
            protocol: [
                "/svc/console",

                // The following are non-Zircon services that some zircon tests assume they
                // can reach, and thus are proxied through svchost. This should mirror the
                // list in //zircon/system/core/svchost/svchost.cc
                "/svc/fuchsia.amber.Control",

                // Services from bootsvc
                "/svc/fuchsia.boot.Arguments",
                "/svc/fuchsia.boot.FactoryItems",
                "/svc/fuchsia.boot.Items",
                "/svc/fuchsia.boot.ReadOnlyLog",
                "/svc/fuchsia.boot.RootJob",
                "/svc/fuchsia.boot.RootJobForInspect",
                "/svc/fuchsia.boot.RootResource",
                "/svc/fuchsia.boot.WriteOnlyLog",
                "/svc/fuchsia.cobalt.LoggerFactory",
                "/svc/fuchsia.devicesettings.DeviceSettingsManager",
                "/svc/fuchsia.exception.Handler",

                // These are services from fshost that driver_manager uses directly
                "/svc/fuchsia.fshost.Admin",

                // These are services from fshost that show up in svchost
                "/svc/fuchsia.fshost.Filesystems",
                "/svc/fuchsia.fshost.Loader",
                "/svc/fuchsia.fshost.Registry",

                // Services from console
                "/svc/fuchsia.hardware.pty.Device",
                "/svc/fuchsia.kernel.Stats",
                "/svc/fuchsia.logger.Log",
                "/svc/fuchsia.logger.LogSink",
                "/svc/fuchsia.net.NameLookup",
                "/svc/fuchsia.net.stack.Log",
                "/svc/fuchsia.net.stack.Stack",
                "/svc/fuchsia.netstack.Netstack",
                "/svc/fuchsia.pkg.PackageResolver",
                "/svc/fuchsia.pkg.RepositoryManager",
                "/svc/fuchsia.pkg.rewrite.Engine",
                "/svc/fuchsia.posix.socket.Provider",

                // Builtin service
                "/svc/fuchsia.process.Launcher",
                "/svc/fuchsia.process.Resolver",
                "/svc/fuchsia.sys.Environment",
                "/svc/fuchsia.sys.Launcher",

                // Services from sysinfo
                "/svc/fuchsia.sysinfo.SysInfo",
                "/svc/fuchsia.tracing.controller.Controller",

                // Service from appmgr
                "/svc/fuchsia.tracing.provider.Registry",
                "/svc/fuchsia.wlan.service.Wlan",
            ],
        },
    ],
    expose: [
        // Device tree
        {
            directory: "/dev",
            from: "self",
            rights: [ "rw*" ],
        },

        // Services proxied by svchost
        {
            protocol: [
                "/svc/fuchsia.device.manager.Administrator",
                "/svc/fuchsia.device.manager.BindDebugger",
                "/svc/fuchsia.device.manager.DebugDumper",
                "/svc/fuchsia.device.NameProvider",
                "/svc/fuchsia.hardware.power.statecontrol.Admin",
                "/svc/fuchsia.kernel.Counter",
                "/svc/fuchsia.kernel.DebugBroker",
                "/svc/fuchsia.paver.Paver",
                "/svc/fuchsia.scheduler.ProfileProvider",
                "/svc/fuchsia.virtualconsole.SessionManager",
            ],
            from: "self",
        },
    ],
}