## <module name="getty" layer="system"> ## <summary>Policy for getty.</summary> ######################################## ## <interface name="getty_transition"> ## <description> ## Execute gettys in the getty domain. ## </description> ## <parameter name="domain"> ## The type of the process performing this action. ## </parameter> ## <infoflow type="read" weight="10"/> ## </interface> # define(`getty_transition',` requires_block_template(`$0'_depend) allow $1 getty_exec_t:file { getattr read execute }; allow $1 getty_t:process transition; type_transition $1 getty_exec_t:process getty_t; dontaudit $1 getty_t:process { noatsecure siginh rlimitinh }; allow $1 getty_t:fd use; allow getty_t $1:fd use; allow getty_t $1:fifo_file rw_file_perms; allow getty_t $1:process sigchld; ') define(`getty_transition_depend',` type getty_t, getty_exec_t; class file { getattr read execute }; class process { transition noatsecure siginh rlimitinh sigchld }; class fd use; class fifo_file rw_file_perms; ') ######################################## ## <interface name="getty_read_log_file"> ## <description> ## Allow process to read getty log file. ## </description> ## <parameter name="domain"> ## The type of the process performing this action. ## </parameter> ## <infoflow type="read" weight="10"/> ## </interface> # define(`getty_read_log_file',` requires_block_template(`$0'_depend) allow $1 getty_log_t:file { getattr read }; ') define(`getty_read_log_file_depend',` type getty_log_t; class file { getattr read }; ') ######################################## ## <interface name="getty_read_config_file"> ## <description> ## Allow process to read getty config file. ## </description> ## <parameter name="domain"> ## The type of the process performing this action. ## </parameter> ## <infoflow type="read" weight="10"/> ## </interface> # define(`getty_read_config_file',` requires_block_template(`$0'_depend) allow $1 getty_etc_t:file { getattr read }; ') define(`getty_read_config_file_depend',` type getty_etc_t; class file { getattr read }; ') ######################################## ## <interface name="getty_modify_config_file"> ## <description> ## Allow process to edit getty config file. ## </description> ## <parameter name="domain"> ## The type of the process performing this action. ## </parameter> ## <infoflow type="read write" weight="10"/> ## </interface> # define(`getty_modify_config_file',` requires_block_template(`$0'_depend) allow $1 getty_etc_t:file { getattr read write }; ') define(`getty_modify_config_file_depend',` type getty_etc_t; class file { getattr read write }; ') ## </module>