selinux-policy/mls/domains/program/utempter.te
2005-11-22 19:28:03 +00:00

52 lines
1.6 KiB
Plaintext

#DESC Utempter - Privileged helper for utmp/wtmp updates
#
# Authors: Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser
# X-Debian-Packages:
#
#################################
#
# Rules for the utempter_t domain.
#
# This is the domain for the utempter program. utempter is
# executed by xterm to update utmp and wtmp.
# utempter_exec_t is the type of the utempter binary.
#
type utempter_t, domain, nscd_client_domain;
in_user_role(utempter_t)
role sysadm_r types utempter_t;
uses_shlib(utempter_t)
type utempter_exec_t, file_type, sysadmfile, exec_type;
domain_auto_trans(userdomain, utempter_exec_t, utempter_t)
allow utempter_t urandom_device_t:chr_file { getattr read };
# Use capabilities.
allow utempter_t self:capability setgid;
allow utempter_t etc_t:file { getattr read };
# Update /var/run/utmp and /var/log/wtmp.
allow utempter_t initrc_var_run_t:file rw_file_perms;
allow utempter_t var_log_t:dir search;
allow utempter_t wtmp_t:file rw_file_perms;
# dontaudit access to /dev/ptmx.
dontaudit utempter_t ptmx_t:chr_file rw_file_perms;
dontaudit utempter_t sysadm_devpts_t:chr_file { read write };
# Allow utemper to write to /tmp/.xses-*
allow utempter_t user_tmpfile:file { getattr write append };
# Inherit and use descriptors from login.
allow utempter_t privfd:fd use;
ifdef(`xdm.te', `can_pipe_xdm(utempter_t)')
allow utempter_t self:unix_stream_socket create_stream_socket_perms;
# Access terminals.
allow utempter_t ttyfile:chr_file getattr;
allow utempter_t ptyfile:chr_file getattr;
allow utempter_t devpts_t:dir search;
dontaudit utempter_t {ttyfile ptyfile}:chr_file { read write };