53 lines
1.9 KiB
Plaintext
53 lines
1.9 KiB
Plaintext
#DESC Pamconsole - PAM console
|
|
# X-Debian-Packages:
|
|
#
|
|
# pam_console_apply
|
|
|
|
daemon_base_domain(pam_console, `, nscd_client_domain, mlsfileread')
|
|
|
|
type pam_var_console_t, file_type, sysadmfile;
|
|
|
|
allow pam_console_t etc_t:file { getattr read ioctl };
|
|
allow pam_console_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
|
# Read /etc/mtab
|
|
allow pam_console_t etc_runtime_t:file { read getattr };
|
|
|
|
# Read /proc/meminfo
|
|
allow pam_console_t proc_t:file { read getattr };
|
|
|
|
allow pam_console_t self:capability { chown fowner fsetid };
|
|
|
|
# Allow access to /dev/console through the fd:
|
|
allow pam_console_t console_device_t:chr_file { read write setattr };
|
|
allow pam_console_t { kernel_t init_t }:fd use;
|
|
|
|
# for /var/run/console.lock checking
|
|
allow pam_console_t { var_t var_run_t }:dir search;
|
|
r_dir_file(pam_console_t, pam_var_console_t)
|
|
dontaudit pam_console_t pam_var_console_t:file write;
|
|
|
|
# Allow to set attributes on /dev entries
|
|
allow pam_console_t device_t:dir { getattr read };
|
|
allow pam_console_t device_t:lnk_file { getattr read };
|
|
# mouse_device_t is for joy sticks
|
|
allow pam_console_t { xserver_misc_device_t framebuf_device_t v4l_device_t apm_bios_t sound_device_t misc_device_t tty_device_t scanner_device_t mouse_device_t power_device_t removable_device_t scsi_generic_device_t }:chr_file { getattr setattr };
|
|
allow pam_console_t { removable_device_t fixed_disk_device_t }:blk_file { getattr setattr };
|
|
|
|
allow pam_console_t mnt_t:dir r_dir_perms;
|
|
|
|
ifdef(`gpm.te', `
|
|
allow pam_console_t gpmctl_t:sock_file { getattr setattr };
|
|
')
|
|
ifdef(`hotplug.te', `
|
|
dontaudit pam_console_t hotplug_etc_t:dir search;
|
|
allow pam_console_t hotplug_t:fd use;
|
|
')
|
|
ifdef(`xdm.te', `
|
|
allow pam_console_t xdm_var_run_t:file { getattr read };
|
|
')
|
|
allow initrc_t pam_var_console_t:dir rw_dir_perms;
|
|
allow initrc_t pam_var_console_t:file unlink;
|
|
allow pam_console_t file_context_t:file { getattr read };
|
|
nsswitch_domain(pam_console_t)
|