Chris PeBenito 9a66d4
Chris PeBenito 5ea24b
policy_module(acct,1.0.0)
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
########################################
Chris PeBenito 9a66d4
#
Chris PeBenito 9a66d4
# Declarations
Chris PeBenito 9a66d4
#
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
type acct_t;
Chris PeBenito 9a66d4
type acct_exec_t;
Chris PeBenito 52e1ed
init_system_domain(acct_t,acct_exec_t)
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
type acct_data_t;
Chris PeBenito 2705f9
logging_log_file(acct_data_t)
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
########################################
Chris PeBenito 9a66d4
#
Chris PeBenito 9a66d4
# Local Policy
Chris PeBenito 9a66d4
#
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
# gzip needs chown capability for some reason
Chris PeBenito 9a66d4
allow acct_t self:capability { sys_pacct chown fsetid };
Chris PeBenito 9a66d4
# not sure why we need kill, the command "last" is reported as using it
Chris PeBenito 9a66d4
dontaudit acct_t self:capability { kill sys_tty_config };
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
allow acct_t self:fifo_file { read write getattr };
Chris PeBenito 9a66d4
allow acct_t self:process signal_perms;
Chris PeBenito 9a66d4
Chris PeBenito c0868a
manage_files_pattern(acct_t,acct_data_t,acct_data_t)
Chris PeBenito c0868a
manage_lnk_files_pattern(acct_t,acct_data_t,acct_data_t)
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
can_exec(acct_t,acct_exec_t)
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
kernel_list_proc(acct_t)
Chris PeBenito 9a66d4
kernel_read_system_state(acct_t)
Chris PeBenito 445522
kernel_read_kernel_sysctls(acct_t)
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
dev_read_sysfs(acct_t)
Chris PeBenito 9a66d4
# for SSP
Chris PeBenito 9a66d4
dev_read_urand(acct_t)
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
fs_search_auto_mountpoints(acct_t)
Chris PeBenito 9a66d4
fs_getattr_xattr_fs(acct_t)
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
term_dontaudit_use_console(acct_t)
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
corecmd_exec_bin(acct_t)
Chris PeBenito 9a66d4
corecmd_exec_shell(acct_t)
Chris PeBenito 9a66d4
Chris PeBenito 15722e
domain_use_interactive_fds(acct_t)
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
files_read_etc_files(acct_t)
Chris PeBenito 9a66d4
files_read_etc_runtime_files(acct_t)
Chris PeBenito 603f90
files_list_usr(acct_t)
Chris PeBenito 9a66d4
# for nscd
Chris PeBenito 9d3bdc
files_dontaudit_search_pids(acct_t)
Chris PeBenito 9a66d4
Chris PeBenito 1c1ac6
init_use_fds(acct_t)
Chris PeBenito 1815ba
init_use_script_ptys(acct_t)
Chris PeBenito f75479
init_exec_script_files(acct_t)
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
libs_use_ld_so(acct_t)
Chris PeBenito 9a66d4
libs_use_shared_libs(acct_t)
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
logging_send_syslog_msg(acct_t)
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
miscfiles_read_localization(acct_t)
Chris PeBenito 9a66d4
Chris PeBenito 103fe2
userdom_dontaudit_search_sysadm_home_dirs(acct_t)
Chris PeBenito 15722e
userdom_dontaudit_use_unpriv_user_fds(acct_t)
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
ifdef(`targeted_policy',`
Chris PeBenito 1815ba
	term_dontaudit_use_unallocated_ttys(acct_t)
Chris PeBenito 1815ba
	term_dontaudit_use_generic_ptys(acct_t)
Chris PeBenito 9e04f5
	files_dontaudit_read_root_files(acct_t)
Chris PeBenito 9a66d4
')
Chris PeBenito 9a66d4
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito bb7170
	optional_policy(`
Chris PeBenito 9a66d4
		# for monthly cron job
Chris PeBenito 103fe2
		auth_log_filetrans_login_records(acct_t)
Chris PeBenito 9a66d4
		auth_manage_login_records(acct_t)
Chris PeBenito 9a66d4
	')
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
	cron_system_entry(acct_t,acct_exec_t)
Chris PeBenito 9a66d4
')
Chris PeBenito 9a66d4
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 1815ba
	nscd_socket_use(acct_t)
Chris PeBenito 52e1ed
')
Chris PeBenito 52e1ed
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 9a66d4
	seutil_sigchld_newrole(acct_t)
Chris PeBenito 9a66d4
')
Chris PeBenito 9a66d4
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 9a66d4
	udev_read_db(acct_t)
Chris PeBenito 9a66d4
')