selinux-policy/strict/domains/program/pamconsole.te

53 lines
1.9 KiB
Plaintext
Raw Normal View History

2005-04-29 17:45:15 +00:00
#DESC Pamconsole - PAM console
# X-Debian-Packages:
#
# pam_console_apply
2005-09-13 13:06:07 +00:00
daemon_base_domain(pam_console, `, nscd_client_domain, mlsfileread')
2005-04-29 17:45:15 +00:00
type pam_var_console_t, file_type, sysadmfile;
allow pam_console_t etc_t:file { getattr read ioctl };
allow pam_console_t self:unix_stream_socket create_stream_socket_perms;
2005-09-13 13:06:07 +00:00
# Read /etc/mtab
allow pam_console_t etc_runtime_t:file { read getattr };
# Read /proc/meminfo
allow pam_console_t proc_t:file { read getattr };
2005-04-29 17:45:15 +00:00
allow pam_console_t self:capability { chown fowner fsetid };
# Allow access to /dev/console through the fd:
2005-09-13 13:06:07 +00:00
allow pam_console_t console_device_t:chr_file { read write setattr };
2005-04-29 17:45:15 +00:00
allow pam_console_t { kernel_t init_t }:fd use;
# for /var/run/console.lock checking
allow pam_console_t { var_t var_run_t }:dir search;
r_dir_file(pam_console_t, pam_var_console_t)
dontaudit pam_console_t pam_var_console_t:file write;
2005-04-29 17:45:15 +00:00
# Allow to set attributes on /dev entries
allow pam_console_t device_t:dir { getattr read };
allow pam_console_t device_t:lnk_file { getattr read };
# mouse_device_t is for joy sticks
2005-09-16 21:20:37 +00:00
allow pam_console_t { xserver_misc_device_t framebuf_device_t v4l_device_t apm_bios_t sound_device_t misc_device_t tty_device_t scanner_device_t mouse_device_t power_device_t removable_device_t scsi_generic_device_t }:chr_file { getattr setattr };
2005-04-29 17:45:15 +00:00
allow pam_console_t { removable_device_t fixed_disk_device_t }:blk_file { getattr setattr };
allow pam_console_t mnt_t:dir r_dir_perms;
ifdef(`gpm.te', `
allow pam_console_t gpmctl_t:sock_file { getattr setattr };
')
ifdef(`hotplug.te', `
dontaudit pam_console_t hotplug_etc_t:dir search;
allow pam_console_t hotplug_t:fd use;
')
ifdef(`xdm.te', `
allow pam_console_t xdm_var_run_t:file { getattr read };
')
2005-09-19 21:17:45 +00:00
allow initrc_t pam_var_console_t:dir rw_dir_perms;
allow initrc_t pam_var_console_t:file unlink;
2005-04-29 17:45:15 +00:00
allow pam_console_t file_context_t:file { getattr read };
nsswitch_domain(pam_console_t)