2005-04-29 17:45:15 +00:00
|
|
|
#DESC Pam - PAM
|
|
|
|
|
# X-Debian-Packages:
|
|
|
|
|
#
|
|
|
|
|
# /sbin/pam_timestamp_check
|
|
|
|
|
type pam_exec_t, file_type, exec_type, sysadmfile;
|
|
|
|
|
type pam_t, domain, privlog, nscd_client_domain;
|
|
|
|
|
general_domain_access(pam_t);
|
|
|
|
|
|
|
|
|
|
type pam_var_run_t, file_type, sysadmfile;
|
|
|
|
|
allow pam_t pam_var_run_t:dir { search getattr read write remove_name };
|
|
|
|
|
allow pam_t pam_var_run_t:file { getattr read unlink };
|
|
|
|
|
|
|
|
|
|
role system_r types pam_t;
|
|
|
|
|
in_user_role(pam_t)
|
|
|
|
|
domain_auto_trans(userdomain, pam_exec_t, pam_t)
|
|
|
|
|
|
|
|
|
|
uses_shlib(pam_t)
|
|
|
|
|
# Read the devpts root directory.
|
|
|
|
|
allow pam_t devpts_t:dir r_dir_perms;
|
|
|
|
|
|
|
|
|
|
# Access terminals.
|
|
|
|
|
allow pam_t { ttyfile ptyfile devtty_t }:chr_file rw_file_perms;
|
|
|
|
|
ifdef(`gnome-pty-helper.te', `allow pam_t gphdomain:fd use;')
|
|
|
|
|
|
|
|
|
|
allow pam_t proc_t:dir search;
|
|
|
|
|
allow pam_t proc_t:{ lnk_file file } { getattr read };
|
|
|
|
|
|
|
|
|
|
# Read the /etc/nsswitch file
|
|
|
|
|
allow pam_t etc_t:file r_file_perms;
|
|
|
|
|
|
|
|
|
|
# Read /var/run.
|
|
|
|
|
allow pam_t { var_t var_run_t }:dir r_dir_perms;
|
|
|
|
|
tmp_domain(pam)
|
|
|
|
|
|
|
|
|
|
allow pam_t local_login_t:fd use;
|
|
|
|
|
dontaudit pam_t self:capability sys_tty_config;
|
|
|
|
|
|
|
|
|
|
allow initrc_t pam_var_run_t:dir rw_dir_perms;
|
|
|
|
|
allow initrc_t pam_var_run_t:file { getattr read unlink };
|
2005-09-15 21:03:45 +00:00
|
|
|
dontaudit pam_t initrc_var_run_t:file rw_file_perms;
|
|
|
|
|
|
|
|
|
|
# Supress xdm denial
|
|
|
|
|
ifdef(`xdm.te', `
|
|
|
|
|
dontaudit pam_t xdm_t:fd use;
|
|
|
|
|
') dnl ifdef
|
