selinux-policy/mls/domains/program/pam.te
2005-11-22 19:28:03 +00:00

46 lines
1.2 KiB
Plaintext

#DESC Pam - PAM
# X-Debian-Packages:
#
# /sbin/pam_timestamp_check
type pam_exec_t, file_type, exec_type, sysadmfile;
type pam_t, domain, privlog, nscd_client_domain;
general_domain_access(pam_t);
type pam_var_run_t, file_type, sysadmfile;
allow pam_t pam_var_run_t:dir { search getattr read write remove_name };
allow pam_t pam_var_run_t:file { getattr read unlink };
role system_r types pam_t;
in_user_role(pam_t)
domain_auto_trans(userdomain, pam_exec_t, pam_t)
uses_shlib(pam_t)
# Read the devpts root directory.
allow pam_t devpts_t:dir r_dir_perms;
# Access terminals.
allow pam_t { ttyfile ptyfile devtty_t }:chr_file rw_file_perms;
ifdef(`gnome-pty-helper.te', `allow pam_t gphdomain:fd use;')
allow pam_t proc_t:dir search;
allow pam_t proc_t:{ lnk_file file } { getattr read };
# Read the /etc/nsswitch file
allow pam_t etc_t:file r_file_perms;
# Read /var/run.
allow pam_t { var_t var_run_t }:dir r_dir_perms;
tmp_domain(pam)
allow pam_t local_login_t:fd use;
dontaudit pam_t self:capability sys_tty_config;
allow initrc_t pam_var_run_t:dir rw_dir_perms;
allow initrc_t pam_var_run_t:file { getattr read unlink };
dontaudit pam_t initrc_var_run_t:file rw_file_perms;
# Supress xdm denial
ifdef(`xdm.te', `
dontaudit pam_t xdm_t:fd use;
') dnl ifdef