41 lines
1.0 KiB
Plaintext
41 lines
1.0 KiB
Plaintext
#DESC Rlogind - Remote login daemon
|
|
#
|
|
# Authors: Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser
|
|
# X-Debian-Packages: rsh-client rsh-redone-client
|
|
# Depends: inetd.te
|
|
#
|
|
|
|
#################################
|
|
#
|
|
# Rules for the rlogind_t domain.
|
|
#
|
|
remote_login_daemon(rlogind)
|
|
typeattribute rlogind_t auth_chkpwd;
|
|
|
|
ifdef(`tcpd.te', `
|
|
domain_auto_trans(tcpd_t, rlogind_exec_t, rlogind_t)
|
|
')
|
|
|
|
# for /usr/lib/telnetlogin
|
|
can_exec(rlogind_t, rlogind_exec_t)
|
|
|
|
# Use capabilities.
|
|
allow rlogind_t self:capability { net_bind_service };
|
|
|
|
# Run login in remote_login_t.
|
|
allow remote_login_t inetd_t:fd use;
|
|
allow remote_login_t inetd_t:tcp_socket rw_file_perms;
|
|
|
|
# Send SIGCHLD to inetd on death.
|
|
allow rlogind_t inetd_t:process sigchld;
|
|
|
|
allow rlogind_t home_dir_type:dir search;
|
|
allow rlogind_t home_type:file { getattr read };
|
|
allow rlogind_t self:file { getattr read };
|
|
allow rlogind_t default_t:dir search;
|
|
typealias rlogind_port_t alias rlogin_port_t;
|
|
read_sysctl(rlogind_t);
|
|
ifdef(`kerberos.te', `
|
|
allow rlogind_t krb5_keytab_t:file { getattr read };
|
|
')
|