selinux-policy/strict/domains/program/pamconsole.te

#DESC Pamconsole - PAM console
# X-Debian-Packages:
#
# pam_console_apply

daemon_base_domain(pam_console, `, nscd_client_domain, mlsfileread')

type pam_var_console_t, file_type, sysadmfile;

allow pam_console_t etc_t:file { getattr read ioctl };
allow pam_console_t self:unix_stream_socket create_stream_socket_perms;

# Read /etc/mtab
allow pam_console_t etc_runtime_t:file { read getattr };

# Read /proc/meminfo
allow pam_console_t proc_t:file { read getattr };

allow pam_console_t self:capability { chown fowner fsetid };

# Allow access to /dev/console through the fd:
allow pam_console_t console_device_t:chr_file { read write setattr };
allow pam_console_t { kernel_t init_t }:fd use;

# for /var/run/console.lock checking
allow pam_console_t { var_t var_run_t }:dir search;
r_dir_file(pam_console_t, pam_var_console_t)

# Allow to set attributes on /dev entries
allow pam_console_t device_t:dir { getattr read };
allow pam_console_t device_t:lnk_file { getattr read };
# mouse_device_t is for joy sticks
allow pam_console_t { framebuf_device_t v4l_device_t apm_bios_t sound_device_t misc_device_t tty_device_t scanner_device_t mouse_device_t power_device_t removable_device_t scsi_generic_device_t }:chr_file { getattr setattr };
allow pam_console_t { removable_device_t fixed_disk_device_t }:blk_file { getattr setattr };

allow pam_console_t mnt_t:dir r_dir_perms;

ifdef(`gpm.te', `
allow pam_console_t gpmctl_t:sock_file { getattr setattr };
')
ifdef(`hotplug.te', `
dontaudit pam_console_t hotplug_etc_t:dir search;
allow pam_console_t hotplug_t:fd use;
')
ifdef(`xdm.te', `
allow pam_console_t xdm_var_run_t:file { getattr read };
')
allow initrc_t pam_var_console_t:dir r_dir_perms;
allow pam_console_t file_context_t:file { getattr read };