selinux-policy/strict/domains/program/pamconsole.te
2005-04-29 17:45:15 +00:00

45 lines
1.6 KiB
Plaintext

#DESC Pamconsole - PAM console
# X-Debian-Packages:
#
# pam_console_apply
daemon_base_domain(pam_console, `, nscd_client_domain')
type pam_var_console_t, file_type, sysadmfile;
allow pam_console_t etc_t:file { getattr read ioctl };
allow pam_console_t self:unix_stream_socket create_stream_socket_perms;
allow pam_console_t self:capability { chown fowner fsetid };
# Allow access to /dev/console through the fd:
allow pam_console_t console_device_t:chr_file { read write };
allow pam_console_t { kernel_t init_t }:fd use;
# for /var/run/console.lock checking
allow pam_console_t { var_t var_run_t }:dir search;
r_dir_file(pam_console_t, pam_var_console_t)
# Allow to set attributes on /dev entries
allow pam_console_t device_t:dir { getattr read };
allow pam_console_t device_t:lnk_file { getattr read };
# mouse_device_t is for joy sticks
allow pam_console_t { framebuf_device_t v4l_device_t apm_bios_t sound_device_t misc_device_t tty_device_t scanner_device_t mouse_device_t power_device_t removable_device_t scsi_generic_device_t }:chr_file { getattr setattr };
allow pam_console_t { removable_device_t fixed_disk_device_t }:blk_file { getattr setattr };
allow pam_console_t mnt_t:dir r_dir_perms;
ifdef(`gpm.te', `
allow pam_console_t gpmctl_t:sock_file { getattr setattr };
')
ifdef(`hotplug.te', `
dontaudit pam_console_t hotplug_etc_t:dir search;
allow pam_console_t hotplug_t:fd use;
')
allow pam_console_t proc_t:file read;
ifdef(`xdm.te', `
allow pam_console_t xdm_var_run_t:file { getattr read };
')
allow initrc_t pam_var_console_t:dir r_dir_perms;
allow pam_console_t file_context_t:file { getattr read };