Chris PeBenito 17de1b
## <summary>Common policy for authentication and user login.</summary>
Chris PeBenito 17de1b
Chris PeBenito 296273
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 296273
##	Role access for password authentication.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 296273
## <param name="role">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 296273
##	Role allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 296273
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 296273
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 296273
interface(`auth_role',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 296273
		type chkpwd_t, chkpwd_exec_t, shadow_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 296273
	role $1 types chkpwd_t;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	# Transition from the user domain to this domain.
Chris PeBenito 296273
	domtrans_pattern($2, chkpwd_exec_t, chkpwd_t)
Chris PeBenito 17de1b
Chris PeBenito 296273
	ps_process_pattern($2, chkpwd_t)
Chris PeBenito 350b6a
Chris PeBenito 296273
	dontaudit $2 shadow_t:file read_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 153ed8
##	Use PAM for authentication.
Chris PeBenito 153ed8
## </summary>
Chris PeBenito 153ed8
## <param name="domain">
Chris PeBenito 153ed8
##	<summary>
Chris PeBenito 153ed8
##	Domain allowed access.
Chris PeBenito 153ed8
##	</summary>
Chris PeBenito 153ed8
## </param>
Chris PeBenito 153ed8
#
Chris PeBenito 153ed8
interface(`auth_use_pam',`
Chris PeBenito 153ed8
Chris PeBenito 153ed8
	# for SSP/ProPolice
Chris PeBenito 153ed8
	dev_read_urand($1)
Chris PeBenito 153ed8
	# for encrypted homedir
Chris PeBenito 153ed8
	dev_read_sysfs($1)
Chris PeBenito 153ed8
Chris PeBenito 153ed8
	auth_domtrans_chk_passwd($1)
Chris PeBenito 153ed8
	auth_domtrans_upd_passwd($1)
Chris PeBenito 153ed8
	auth_dontaudit_read_shadow($1)
Chris PeBenito 153ed8
	auth_read_login_records($1)
Chris PeBenito 153ed8
	auth_append_login_records($1)
Chris PeBenito 153ed8
	auth_rw_lastlog($1)
Chris PeBenito 153ed8
	auth_rw_faillog($1)
Chris PeBenito 153ed8
	auth_exec_pam($1)
Chris PeBenito 153ed8
	auth_use_nsswitch($1)
Chris PeBenito 153ed8
Dan Walsh c16ffd
	init_rw_stream_sockets($1)
Dan Walsh c16ffd
Chris PeBenito 153ed8
	logging_send_audit_msgs($1)
Chris PeBenito 153ed8
	logging_send_syslog_msg($1)
Chris PeBenito 153ed8
Chris PeBenito 153ed8
	optional_policy(`
Chris PeBenito 153ed8
		dbus_system_bus_client($1)
Chris PeBenito 153ed8
Chris PeBenito 153ed8
		optional_policy(`
Chris PeBenito 153ed8
			consolekit_dbus_chat($1)
Chris PeBenito 153ed8
		')
Dan Walsh f5b49a
Dan Walsh f5b49a
		optional_policy(`
Dan Walsh f5b49a
			fprintd_dbus_chat($1)
Dan Walsh f5b49a
		')
Chris PeBenito 153ed8
	')
Chris PeBenito 153ed8
Chris PeBenito 153ed8
	optional_policy(`
Chris PeBenito 153ed8
		kerberos_manage_host_rcache($1)
Chris PeBenito 153ed8
		kerberos_read_config($1)
Chris PeBenito 153ed8
	')
Chris PeBenito 153ed8
Chris PeBenito 153ed8
	optional_policy(`
Chris PeBenito 153ed8
		nis_authenticate($1)
Chris PeBenito 153ed8
	')
Chris PeBenito 153ed8
')
Chris PeBenito 153ed8
Chris PeBenito 153ed8
########################################
Chris PeBenito 153ed8
## <summary>
Chris PeBenito 4b3b46
##	Make the specified domain used for a login program.
Chris PeBenito 4b3b46
## </summary>
Chris PeBenito 4b3b46
## <param name="domain">
Chris PeBenito 4b3b46
##	<summary>
Chris PeBenito 4b3b46
##	Domain type used for a login program domain.
Chris PeBenito 4b3b46
##	</summary>
Chris PeBenito 4b3b46
## </param>
Chris PeBenito 4b3b46
#
Chris PeBenito 4b3b46
interface(`auth_login_pgm_domain',`
Chris PeBenito 7d4161
	gen_require(`
Chris PeBenito 30425a
		type var_auth_t, auth_cache_t;
Dan Walsh 3eaa99
		attribute polydomain;
Chris PeBenito 7d4161
	')
Chris PeBenito 4b3b46
Chris PeBenito 4b3b46
	domain_type($1)
Dan Walsh 3eaa99
	typeattribute $1 polydomain;
Dan Walsh 3eaa99
Chris PeBenito 4b3b46
	domain_subj_id_change_exemption($1)
Chris PeBenito 4b3b46
	domain_role_change_exemption($1)
Chris PeBenito 4b3b46
	domain_obj_id_change_exemption($1)
Chris PeBenito 4b3b46
	role system_r types $1;
Chris PeBenito 4b3b46
Chris PeBenito 153ed8
	# Needed for pam_selinux_permit to cleanup properly
Chris PeBenito 153ed8
	domain_read_all_domains_state($1)
Chris PeBenito 153ed8
	domain_kill_all_domains($1)
Chris PeBenito 153ed8
Chris PeBenito 153ed8
	# pam_keyring
Chris PeBenito 153ed8
	allow $1 self:capability ipc_lock;
Chris PeBenito 153ed8
	allow $1 self:process setkeycreate;
Chris PeBenito 153ed8
	allow $1 self:key manage_key_perms;
Dan Walsh 3eaa99
	userdom_manage_all_users_keys($1)
Chris PeBenito 153ed8
Chris PeBenito 7d4161
	files_list_var_lib($1)
Dan Walsh c6fa93
	manage_dirs_pattern($1, var_auth_t, var_auth_t)
Chris PeBenito 7d4161
	manage_files_pattern($1, var_auth_t, var_auth_t)
Chris PeBenito 7d4161
Chris PeBenito 30425a
	manage_dirs_pattern($1, auth_cache_t, auth_cache_t)
Chris PeBenito 30425a
	manage_files_pattern($1, auth_cache_t, auth_cache_t)
Chris PeBenito 30425a
	manage_sock_files_pattern($1, auth_cache_t, auth_cache_t)
Chris PeBenito 30425a
	files_var_filetrans($1, auth_cache_t, dir)
Chris PeBenito 30425a
Chris PeBenito 153ed8
	# needed for afs - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=253321
Chris PeBenito 153ed8
	kernel_rw_afs_state($1)
Chris PeBenito 153ed8
Chris PeBenito 7d4161
	# for fingerprint readers
Chris PeBenito 7d4161
	dev_rw_input_dev($1)
Chris PeBenito 7d4161
	dev_rw_generic_usb_dev($1)
Chris PeBenito 4b3b46
Chris PeBenito 4b3b46
	files_read_etc_files($1)
Chris PeBenito 4b3b46
Chris PeBenito 7d4161
	fs_list_auto_mountpoints($1)
Dan Walsh 3eaa99
	fs_manage_cgroup_dirs($1)
Dan Walsh 3eaa99
	fs_manage_cgroup_files($1)
Chris PeBenito 7d4161
Chris PeBenito 4b3b46
	selinux_get_fs_mount($1)
Chris PeBenito 4b3b46
	selinux_validate_context($1)
Chris PeBenito 4b3b46
	selinux_compute_access_vector($1)
Chris PeBenito 4b3b46
	selinux_compute_create_context($1)
Chris PeBenito 4b3b46
	selinux_compute_relabel_context($1)
Chris PeBenito 4b3b46
	selinux_compute_user_contexts($1)
Chris PeBenito 4b3b46
Chris PeBenito f8233a
	mls_file_read_all_levels($1)
Chris PeBenito f8233a
	mls_file_write_all_levels($1)
Chris PeBenito 4b3b46
	mls_file_upgrade($1)
Chris PeBenito 4b3b46
	mls_file_downgrade($1)
Chris PeBenito 4b3b46
	mls_process_set_level($1)
Chris PeBenito 6b19be
	mls_fd_share_all_levels($1)
Chris PeBenito 4b3b46
Dan Walsh 3eaa99
	auth_manage_pam_pid($1)
Chris PeBenito 153ed8
	auth_use_pam($1)
Chris PeBenito 4b3b46
Chris PeBenito 4b3b46
	init_rw_utmp($1)
Chris PeBenito 4b3b46
Chris PeBenito 7cbfeb
	logging_set_loginuid($1)
Chris PeBenito 153ed8
	logging_set_tty_audit($1)
Chris PeBenito 4b3b46
Chris PeBenito 4b3b46
	seutil_read_config($1)
Chris PeBenito 4b3b46
	seutil_read_default_contexts($1)
Chris PeBenito 4b3b46
Dan Walsh 3eaa99
	userdom_set_rlimitnh($1)
Dan Walsh 3eaa99
	userdom_read_user_home_content_symlinks($1)
Dan Walsh 3eaa99
	userdom_delete_user_tmp_files($1)
Dan Walsh 3eaa99
	userdom_search_admin_dir($1)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	optional_policy(`
Dan Walsh 3eaa99
		afs_rw_udp_sockets($1)
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	optional_policy(`
Dan Walsh 3eaa99
		kerberos_read_config($1)
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	optional_policy(`
Dan Walsh 3eaa99
		oddjob_dbus_chat($1)
Dan Walsh 3eaa99
		oddjob_domtrans_mkhomedir($1)
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	optional_policy(`
Dan Walsh 3eaa99
		corecmd_exec_bin($1)
Dan Walsh 3eaa99
		storage_getattr_fixed_disk_dev($1)
Dan Walsh 3eaa99
		mount_domtrans($1)
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	optional_policy(`
Dan Walsh 3eaa99
		fprintd_dbus_chat($1)
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	optional_policy(`
Dan Walsh 3eaa99
		ssh_agent_exec($1)
Dan Walsh 3eaa99
		ssh_read_user_home_files($1)
Dan Walsh 3eaa99
		userdom_read_user_home_content_files($1)
Chris PeBenito 4b3b46
	')
Chris PeBenito 4b3b46
')
Chris PeBenito 4b3b46
Chris PeBenito 4b3b46
########################################
Chris PeBenito 4b3b46
## <summary>
Chris PeBenito 17de1b
##	Use the login program as an entry point program.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift a0546c
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_login_entry_type',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type login_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 3f67f7
	domain_entry_file($1, login_exec_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute a login_program in the target domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift a0546c
##	Domain allowed to transition.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="target_domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The type of the login_program process.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_domtrans_login_program',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type login_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	corecmd_search_bin($1)
Chris PeBenito 3f67f7
	domtrans_pattern($1, login_exec_t,$2)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito e070dd
##	Execute a login_program in the target domain,
Chris PeBenito e070dd
##	with a range transition.
Chris PeBenito e070dd
## </summary>
Chris PeBenito e070dd
## <param name="domain">
Chris PeBenito e070dd
##	<summary>
Dominick Grift a0546c
##	Domain allowed to transition.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="target_domain">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	The type of the login_program process.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="range">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Range of the login program.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
#
Chris PeBenito e070dd
interface(`auth_ranged_domtrans_login_program',`
Chris PeBenito e070dd
	gen_require(`
Chris PeBenito e070dd
		type login_exec_t;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e070dd
	auth_domtrans_login_program($1,$2)
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mcs',`
Chris PeBenito e070dd
		range_transition $1 login_exec_t:process $3;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mls',`
Chris PeBenito e070dd
		range_transition $1 login_exec_t:process $3;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
')
Chris PeBenito e070dd
Chris PeBenito e070dd
########################################
Chris PeBenito e070dd
## <summary>
Chris PeBenito 30425a
##	Search authentication cache
Chris PeBenito 30425a
## </summary>
Chris PeBenito 30425a
## <param name="domain">
Chris PeBenito 30425a
##	<summary>
Chris PeBenito 30425a
##	Domain allowed access.
Chris PeBenito 30425a
##	</summary>
Chris PeBenito 30425a
## </param>
Chris PeBenito 30425a
#
Chris PeBenito 30425a
interface(`auth_search_cache',`
Chris PeBenito 30425a
	gen_require(`
Chris PeBenito 30425a
		type auth_cache_t;
Chris PeBenito 30425a
	')
Chris PeBenito 30425a
Chris PeBenito 3f67f7
	allow $1 auth_cache_t:dir search_dir_perms;
Chris PeBenito 30425a
')
Chris PeBenito 30425a
Chris PeBenito 30425a
########################################
Chris PeBenito 30425a
## <summary>
Chris PeBenito 30425a
##	Read authentication cache
Chris PeBenito 30425a
## </summary>
Chris PeBenito 30425a
## <param name="domain">
Chris PeBenito 30425a
##	<summary>
Chris PeBenito 30425a
##	Domain allowed access.
Chris PeBenito 30425a
##	</summary>
Chris PeBenito 30425a
## </param>
Chris PeBenito 30425a
#
Chris PeBenito 30425a
interface(`auth_read_cache',`
Chris PeBenito 30425a
	gen_require(`
Chris PeBenito 30425a
		type auth_cache_t;
Chris PeBenito 30425a
	')
Chris PeBenito 30425a
Chris PeBenito 3f67f7
	read_files_pattern($1, auth_cache_t, auth_cache_t)
Chris PeBenito 30425a
')
Chris PeBenito 30425a
Chris PeBenito 30425a
########################################
Chris PeBenito 30425a
## <summary>
Chris PeBenito 30425a
##	Read/Write authentication cache
Chris PeBenito 30425a
## </summary>
Chris PeBenito 30425a
## <param name="domain">
Chris PeBenito 30425a
##	<summary>
Chris PeBenito 30425a
##	Domain allowed access.
Chris PeBenito 30425a
##	</summary>
Chris PeBenito 30425a
## </param>
Chris PeBenito 30425a
#
Chris PeBenito 30425a
interface(`auth_rw_cache',`
Chris PeBenito 30425a
	gen_require(`
Chris PeBenito 30425a
		type auth_cache_t;
Chris PeBenito 30425a
	')
Chris PeBenito 30425a
Chris PeBenito 3f67f7
	rw_files_pattern($1, auth_cache_t, auth_cache_t)
Chris PeBenito 30425a
')
Chris PeBenito 30425a
Chris PeBenito 30425a
########################################
Chris PeBenito 30425a
## <summary>
Chris PeBenito 30425a
##	Manage authentication cache
Chris PeBenito 30425a
## </summary>
Chris PeBenito 30425a
## <param name="domain">
Chris PeBenito 30425a
##	<summary>
Chris PeBenito 30425a
##	Domain allowed access.
Chris PeBenito 30425a
##	</summary>
Chris PeBenito 30425a
## </param>
Chris PeBenito 30425a
#
Chris PeBenito 30425a
interface(`auth_manage_cache',`
Chris PeBenito 30425a
	gen_require(`
Chris PeBenito 30425a
		type auth_cache_t;
Chris PeBenito 30425a
	')
Chris PeBenito 30425a
Chris PeBenito 153ed8
	manage_dirs_pattern($1, auth_cache_t, auth_cache_t)
Chris PeBenito 3f67f7
	manage_files_pattern($1, auth_cache_t, auth_cache_t)
Chris PeBenito 30425a
')
Chris PeBenito 30425a
Chris PeBenito 30425a
#######################################
Chris PeBenito 30425a
## <summary>
Chris PeBenito 30425a
##	Automatic transition from cache_t to cache.
Chris PeBenito 30425a
## </summary>
Chris PeBenito 30425a
## <param name="domain">
Chris PeBenito 30425a
##	<summary>
Chris PeBenito 30425a
##	Domain allowed access.
Chris PeBenito 30425a
##	</summary>
Chris PeBenito 30425a
## </param>
Chris PeBenito 30425a
#
Chris PeBenito 30425a
interface(`auth_var_filetrans_cache',`
Chris PeBenito 30425a
	gen_require(`
Chris PeBenito 30425a
		type auth_cache_t;
Chris PeBenito 30425a
	')
Chris PeBenito 30425a
Chris PeBenito 3f67f7
	files_var_filetrans($1, auth_cache_t, { file dir } )
Chris PeBenito 30425a
')
Chris PeBenito 30425a
Chris PeBenito 30425a
########################################
Chris PeBenito 30425a
## <summary>
Chris PeBenito 17de1b
##	Run unix_chkpwd to check a password.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift a0546c
##	Domain allowed to transition.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_domtrans_chk_passwd',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 296273
		type chkpwd_t, chkpwd_exec_t, shadow_t;
Chris PeBenito 30425a
		type auth_cache_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 30425a
	allow $1 auth_cache_t:dir search_dir_perms;
Chris PeBenito 30425a
Chris PeBenito 8021cb
	corecmd_search_bin($1)
Chris PeBenito 296273
	domtrans_pattern($1, chkpwd_exec_t, chkpwd_t)
Chris PeBenito 17de1b
Dominick Grift 03dd57
	dontaudit $1 shadow_t:file read_file_perms;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dev_read_rand($1)
Chris PeBenito 17de1b
	dev_read_urand($1)
Chris PeBenito 17de1b
Chris PeBenito 153ed8
	auth_use_nsswitch($1)
Chris PeBenito 153ed8
	auth_rw_faillog($1)
Chris PeBenito 153ed8
Chris PeBenito d5b81a
	logging_send_audit_msgs($1)
Chris PeBenito d5b81a
Chris PeBenito 17de1b
	miscfiles_read_certs($1)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	optional_policy(`
Chris PeBenito 153ed8
		kerberos_read_keytab($1)
Chris PeBenito 153ed8
		kerberos_connect_524($1)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	optional_policy(`
Dan Walsh 3eaa99
		pcscd_manage_pub_files($1)
Dan Walsh 3eaa99
		pcscd_manage_pub_pipes($1)
Chris PeBenito 6b19be
		pcscd_stream_connect($1)
Chris PeBenito 6b19be
	')
Chris PeBenito 6b19be
Chris PeBenito 6b19be
	optional_policy(`
Chris PeBenito 17de1b
		samba_stream_connect_winbind($1)
Chris PeBenito 17de1b
	')
Dan Walsh 3eaa99
	auth_domtrans_upd_passwd($1)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 153ed8
##	Run unix_chkpwd to check a password.
Chris PeBenito 153ed8
## 	Stripped down version to be called within boolean
Chris PeBenito 153ed8
## </summary>
Chris PeBenito 153ed8
## <param name="domain">
Chris PeBenito 153ed8
##	<summary>
Dominick Grift a0546c
##	Domain allowed to transition.
Chris PeBenito 153ed8
##	</summary>
Chris PeBenito 153ed8
## </param>
Chris PeBenito 153ed8
#
Chris PeBenito 153ed8
interface(`auth_domtrans_chkpwd',`
Chris PeBenito 153ed8
	gen_require(`
Chris PeBenito 153ed8
		type chkpwd_t, chkpwd_exec_t, shadow_t;
Chris PeBenito 153ed8
	')
Chris PeBenito 153ed8
Chris PeBenito 153ed8
	corecmd_search_bin($1)
Chris PeBenito 153ed8
	domtrans_pattern($1, chkpwd_exec_t, chkpwd_t)
Chris PeBenito 153ed8
	dontaudit $1 shadow_t:file { getattr read };
Chris PeBenito 153ed8
	auth_domtrans_upd_passwd($1)
Chris PeBenito 153ed8
')
Chris PeBenito 153ed8
Chris PeBenito 153ed8
########################################
Chris PeBenito 153ed8
## <summary>
Chris PeBenito 7d4161
##	Execute chkpwd programs in the chkpwd domain.
Chris PeBenito 7d4161
## </summary>
Chris PeBenito 7d4161
## <param name="domain">
Chris PeBenito 7d4161
##	<summary>
Dominick Grift a0546c
##	Domain allowed to transition.
Chris PeBenito 7d4161
##	</summary>
Chris PeBenito 7d4161
## </param>
Chris PeBenito 7d4161
## <param name="role">
Chris PeBenito 7d4161
##	<summary>
Chris PeBenito 6138d3
##	The role to allow the chkpwd domain.
Chris PeBenito 7d4161
##	</summary>
Chris PeBenito 7d4161
## </param>
Chris PeBenito 7d4161
#
Chris PeBenito 7d4161
interface(`auth_run_chk_passwd',`
Chris PeBenito 7d4161
	gen_require(`
Chris PeBenito 296273
		type chkpwd_t;
Chris PeBenito 7d4161
	')
Chris PeBenito 7d4161
Chris PeBenito 7d4161
	auth_domtrans_chk_passwd($1)
Chris PeBenito 296273
	role $2 types chkpwd_t;
Dan Walsh 3eaa99
	auth_run_upd_passwd($1, $2)
Chris PeBenito 7d4161
')
Chris PeBenito 7d4161
Chris PeBenito 7d4161
########################################
Chris PeBenito 7d4161
## <summary>
Chris PeBenito 7d4161
##	Execute a domain transition to run unix_update.
Chris PeBenito 7d4161
## </summary>
Chris PeBenito 7d4161
## <param name="domain">
Chris PeBenito 7d4161
## <summary>
Chris PeBenito 7d4161
##	Domain allowed to transition.
Chris PeBenito 7d4161
## </summary>
Chris PeBenito 7d4161
## </param>
Chris PeBenito 7d4161
#
Chris PeBenito 7d4161
interface(`auth_domtrans_upd_passwd',`
Chris PeBenito 7d4161
	gen_require(`
Chris PeBenito 7d4161
		type updpwd_t, updpwd_exec_t;
Chris PeBenito 7d4161
	')
Chris PeBenito 7d4161
Chris PeBenito 3f67f7
	domtrans_pattern($1, updpwd_exec_t, updpwd_t)
Chris PeBenito 7d4161
	auth_dontaudit_read_shadow($1)
Chris PeBenito 7d4161
Chris PeBenito 7d4161
')
Chris PeBenito 7d4161
Chris PeBenito 7d4161
########################################
Chris PeBenito 7d4161
## <summary>
Chris PeBenito 7d4161
##	Execute updpwd programs in the updpwd domain.
Chris PeBenito 7d4161
## </summary>
Chris PeBenito 7d4161
## <param name="domain">
Chris PeBenito 7d4161
##	<summary>
Dominick Grift a0546c
##	Domain allowed to transition.
Chris PeBenito 7d4161
##	</summary>
Chris PeBenito 7d4161
## </param>
Chris PeBenito 7d4161
## <param name="role">
Chris PeBenito 7d4161
##	<summary>
Chris PeBenito 7d4161
##	The role to allow the updpwd domain.
Chris PeBenito 7d4161
##	</summary>
Chris PeBenito 7d4161
## </param>
Chris PeBenito 7d4161
#
Chris PeBenito 7d4161
interface(`auth_run_upd_passwd',`
Chris PeBenito 7d4161
	gen_require(`
Chris PeBenito 7d4161
		type updpwd_t;
Chris PeBenito 7d4161
	')
Chris PeBenito 7d4161
Chris PeBenito 7d4161
	auth_domtrans_upd_passwd($1)
Chris PeBenito 7d4161
	role $2 types updpwd_t;
Chris PeBenito 7d4161
')
Chris PeBenito 7d4161
Chris PeBenito 7d4161
########################################
Chris PeBenito 7d4161
## <summary>
Chris PeBenito 17de1b
##	Get the attributes of the shadow passwords file.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_getattr_shadow',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type shadow_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_etc($1)
Chris PeBenito 17de1b
	allow $1 shadow_t:file getattr;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Do not audit attempts to get the attributes
Chris PeBenito 17de1b
##	of the shadow passwords file.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain to not audit.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_dontaudit_getattr_shadow',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type shadow_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 shadow_t:file getattr;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read the shadow passwords file (/etc/shadow)
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# cjp: these next three interfaces are split 
Chris PeBenito 17de1b
# since typeattribute does not work in conditionals
Chris PeBenito 17de1b
# yet, otherwise they should be one interface.
Chris PeBenito 17de1b
# 
Chris PeBenito 17de1b
interface(`auth_read_shadow',`
Chris PeBenito 17de1b
	auth_can_read_shadow_passwords($1)
Chris PeBenito 17de1b
	auth_tunable_read_shadow($1)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Pass shadow assertion for reading.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <desc>
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
##	Pass shadow assertion for reading.
Chris PeBenito 17de1b
##	This should only be used with
Chris PeBenito 17de1b
##	auth_tunable_read_shadow(), and
Chris PeBenito 17de1b
##	only exists because typeattribute
Chris PeBenito 17de1b
##	does not work in conditionals.
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
## </desc>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_can_read_shadow_passwords',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		attribute can_read_shadow_passwords;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	typeattribute $1 can_read_shadow_passwords;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read the shadow password file.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <desc>
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
##	Read the shadow password file.  This
Chris PeBenito 17de1b
##	should only be used in a conditional;
Chris PeBenito 17de1b
##	it does not pass the reading shadow
Chris PeBenito 17de1b
##	assertion.
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
## </desc>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_tunable_read_shadow',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type shadow_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_list_etc($1)
Chris PeBenito c0868a
	allow $1 shadow_t:file read_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Do not audit attempts to read the shadow
Chris PeBenito 17de1b
##	password file (/etc/shadow).
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift a0546c
##	Domain to not audit.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_dontaudit_read_shadow',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type shadow_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 932c35
	dontaudit $1 shadow_t:file read_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read and write the shadow password file (/etc/shadow).
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_rw_shadow',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		attribute can_read_shadow_passwords, can_write_shadow_passwords;
Chris PeBenito 17de1b
		type shadow_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_list_etc($1)
Chris PeBenito 17de1b
	allow $1 shadow_t:file rw_file_perms;
Chris PeBenito 17de1b
	typeattribute $1 can_read_shadow_passwords, can_write_shadow_passwords;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Create, read, write, and delete the shadow
Chris PeBenito 17de1b
##	password file.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_manage_shadow',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		attribute can_read_shadow_passwords, can_write_shadow_passwords;
Chris PeBenito 17de1b
		type shadow_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito ba1a54
	allow $1 shadow_t:file manage_file_perms;
Chris PeBenito 17de1b
	typeattribute $1 can_read_shadow_passwords, can_write_shadow_passwords;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#######################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Automatic transition from etc to shadow.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_etc_filetrans_shadow',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type shadow_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 3f67f7
	files_etc_filetrans($1, shadow_t, file)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#######################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Relabel to the shadow
Chris PeBenito 17de1b
##	password file type.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_relabelto_shadow',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		attribute can_relabelto_shadow_passwords;
Chris PeBenito 17de1b
		type shadow_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_etc($1)
Chris PeBenito 17de1b
	allow $1 shadow_t:file relabelto;
Chris PeBenito 17de1b
	typeattribute $1 can_relabelto_shadow_passwords;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#######################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Relabel from and to the shadow
Chris PeBenito 17de1b
##	password file type.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_relabel_shadow',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		attribute can_relabelto_shadow_passwords;
Chris PeBenito 17de1b
		type shadow_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_etc($1)
Chris PeBenito 17de1b
	allow $1 shadow_t:file { relabelfrom relabelto };
Chris PeBenito 17de1b
	typeattribute $1 can_relabelto_shadow_passwords;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#######################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Append to the login failure log.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_append_faillog',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type faillog_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	logging_search_logs($1)
Chris PeBenito c0868a
	allow $1 faillog_t:file append_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read and write the login failure log.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_rw_faillog',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type faillog_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	logging_search_logs($1)
Chris PeBenito 17de1b
	allow $1 faillog_t:file rw_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#######################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read the last logins log.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito bbcd3c
## <rolecap/>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_read_lastlog',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type lastlog_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	logging_search_logs($1)
Chris PeBenito c0868a
	allow $1 lastlog_t:file read_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#######################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Append only to the last logins log.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_append_lastlog',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type lastlog_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	logging_search_logs($1)
Chris PeBenito c0868a
	allow $1 lastlog_t:file { append_file_perms lock };
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#######################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read and write to the last logins log.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_rw_lastlog',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type lastlog_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	logging_search_logs($1)
Chris PeBenito c0868a
	allow $1 lastlog_t:file { rw_file_perms lock setattr };
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute pam programs in the pam domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift a0546c
##	Domain allowed to transition.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_domtrans_pam',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type pam_t, pam_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 3f67f7
	domtrans_pattern($1, pam_exec_t, pam_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 30425a
##	Send generic signals to pam processes.
Chris PeBenito 7d4161
## </summary>
Chris PeBenito 7d4161
## <param name="domain">
Chris PeBenito 7d4161
##	<summary>
Chris PeBenito 7d4161
##	Domain allowed access.
Chris PeBenito 7d4161
##	</summary>
Chris PeBenito 7d4161
## </param>
Chris PeBenito 7d4161
#
Chris PeBenito 7d4161
interface(`auth_signal_pam',`
Chris PeBenito 7d4161
	gen_require(`
Chris PeBenito 7d4161
		type pam_t;
Chris PeBenito 7d4161
	')
Chris PeBenito 7d4161
Chris PeBenito 7d4161
	allow $1 pam_t:process signal;
Chris PeBenito 7d4161
')
Chris PeBenito 7d4161
Chris PeBenito 7d4161
########################################
Chris PeBenito 7d4161
## <summary>
Chris PeBenito 17de1b
##	Execute pam programs in the PAM domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift a0546c
##	Domain allowed to transition.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="role">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The role to allow the PAM domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_run_pam',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type pam_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	auth_domtrans_pam($1)
Chris PeBenito 17de1b
	role $2 types pam_t;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute the pam program.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_exec_pam',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type pam_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 3f67f7
	can_exec($1, pam_exec_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Dan Walsh 3eaa99
##	Read var auth files. Used by various other applications
Dan Walsh 3eaa99
##	and pam applets etc.
Dan Walsh 3eaa99
## </summary>
Dan Walsh 3eaa99
## <param name="domain">
Dan Walsh 3eaa99
##	<summary>
Dan Walsh 3eaa99
##	Domain allowed access.
Dan Walsh 3eaa99
##	</summary>
Dan Walsh 3eaa99
## </param>
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
interface(`auth_read_var_auth',`
Dan Walsh 3eaa99
	gen_require(`
Dan Walsh 3eaa99
		type var_auth_t;
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	files_search_var($1)
Dan Walsh 3eaa99
	read_files_pattern($1, var_auth_t, var_auth_t)
Dan Walsh 3eaa99
')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
########################################
Dan Walsh 3eaa99
## <summary>
Chris PeBenito 17de1b
##	Manage var auth files. Used by various other applications
Chris PeBenito 17de1b
##	and pam applets etc.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_manage_var_auth',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type var_auth_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_var($1)
Chris PeBenito ba1a54
	allow $1 var_auth_t:dir manage_dir_perms;
Chris PeBenito 17de1b
	allow $1 var_auth_t:file rw_file_perms;
Chris PeBenito 0b36a2
	allow $1 var_auth_t:lnk_file rw_lnk_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read PAM PID files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_read_pam_pid',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type pam_var_run_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_pids($1)
Chris PeBenito ba1a54
	allow $1 pam_var_run_t:dir list_dir_perms;
Chris PeBenito c0868a
	allow $1 pam_var_run_t:file read_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#######################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Do not audit attemps to read PAM PID files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain to not audit.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_dontaudit_read_pam_pid',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type pam_var_run_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 pam_var_run_t:file { getattr read };
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Delete pam PID files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_delete_pam_pid',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type pam_var_run_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_pids($1)
Chris PeBenito c0868a
	allow $1 pam_var_run_t:dir del_entry_dir_perms;
Chris PeBenito c0868a
	allow $1 pam_var_run_t:file delete_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Manage pam PID files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_manage_pam_pid',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type pam_var_run_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_pids($1)
Chris PeBenito ba1a54
	allow $1 pam_var_run_t:dir manage_dir_perms;
Chris PeBenito ba1a54
	allow $1 pam_var_run_t:file manage_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute pam_console with a domain transition.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift a0546c
##	Domain allowed to transition.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_domtrans_pam_console',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type pam_console_t, pam_console_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 3f67f7
	domtrans_pattern($1, pam_console_exec_t, pam_console_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Search the contents of the
Chris PeBenito 17de1b
##	pam_console data directory.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_search_pam_console_data',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type pam_var_console_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_pids($1)
Chris PeBenito 17de1b
	allow $1 pam_var_console_t:dir search_dir_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	List the contents of the pam_console
Chris PeBenito 17de1b
##	data directory.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_list_pam_console_data',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type pam_var_console_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_pids($1)
Chris PeBenito ba1a54
	allow $1 pam_var_console_t:dir list_dir_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read pam_console data files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_read_pam_console_data',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type pam_var_console_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_pids($1)
Chris PeBenito ba1a54
	allow $1 pam_var_console_t:dir list_dir_perms;
Chris PeBenito c0868a
	allow $1 pam_var_console_t:file read_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Create, read, write, and delete
Chris PeBenito 17de1b
##	pam_console data files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_manage_pam_console_data',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type pam_var_console_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_pids($1)
Chris PeBenito 3f67f7
	manage_files_pattern($1, pam_var_console_t, pam_var_console_t)
Chris PeBenito 3f67f7
	manage_lnk_files_pattern($1, pam_var_console_t, pam_var_console_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#######################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Delete pam_console data.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_delete_pam_console_data',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type pam_var_console_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_var($1)
Chris PeBenito 17de1b
	files_search_pids($1)
Chris PeBenito 3f67f7
	delete_files_pattern($1, pam_var_console_t, pam_var_console_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read all directories on the filesystem, except
Chris PeBenito 17de1b
##	the shadow passwords and listed exceptions.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift a0546c
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="exception_types" optional="true">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The types to be excluded.  Each type or attribute
Chris PeBenito 17de1b
##	must be negated by the caller.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_read_all_dirs_except_shadow',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type shadow_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_read_all_dirs_except($1,$2 -shadow_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read all files on the filesystem, except
Chris PeBenito 17de1b
##	the shadow passwords and listed exceptions.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift a0546c
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="exception_types" optional="true">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The types to be excluded.  Each type or attribute
Chris PeBenito 17de1b
##	must be negated by the caller.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito bbcd3c
## <rolecap/>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_read_all_files_except_shadow',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type shadow_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_read_all_files_except($1,$2 -shadow_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read all symbolic links on the filesystem, except
Chris PeBenito 17de1b
##	the shadow passwords and listed exceptions.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift a0546c
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="exception_types" optional="true">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The types to be excluded.  Each type or attribute
Chris PeBenito 17de1b
##	must be negated by the caller.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_read_all_symlinks_except_shadow',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type shadow_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_read_all_symlinks_except($1,$2 -shadow_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Relabel all files on the filesystem, except
Chris PeBenito 17de1b
##	the shadow passwords and listed exceptions.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift a0546c
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="exception_types" optional="true">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The types to be excluded.  Each type or attribute
Chris PeBenito 17de1b
##	must be negated by the caller.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
Chris PeBenito 17de1b
interface(`auth_relabel_all_files_except_shadow',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type shadow_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_relabel_all_files($1,$2 -shadow_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 153ed8
##	Read and write all files on the filesystem, except
Chris PeBenito 153ed8
##	the shadow passwords and listed exceptions.
Chris PeBenito 153ed8
## </summary>
Chris PeBenito 153ed8
## <param name="domain">
Chris PeBenito 153ed8
##	<summary>
Dominick Grift a0546c
##	Domain allowed access.
Chris PeBenito 153ed8
##	</summary>
Chris PeBenito 153ed8
## </param>
Chris PeBenito 153ed8
## <param name="exception_types" optional="true">
Chris PeBenito 153ed8
##	<summary>
Chris PeBenito 153ed8
##	The types to be excluded.  Each type or attribute
Chris PeBenito 153ed8
##	must be negated by the caller.
Chris PeBenito 153ed8
##	</summary>
Chris PeBenito 153ed8
## </param>
Chris PeBenito 153ed8
#
Chris PeBenito 153ed8
Chris PeBenito 153ed8
interface(`auth_rw_all_files_except_shadow',`
Chris PeBenito 153ed8
	gen_require(`
Chris PeBenito 153ed8
		type shadow_t;
Chris PeBenito 153ed8
	')
Chris PeBenito 153ed8
Chris PeBenito 153ed8
	files_rw_all_files($1,$2 -shadow_t)
Chris PeBenito 153ed8
')
Chris PeBenito 153ed8
Chris PeBenito 153ed8
########################################
Chris PeBenito 153ed8
## <summary>
Chris PeBenito 17de1b
##	Manage all files on the filesystem, except
Chris PeBenito 17de1b
##	the shadow passwords and listed exceptions.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift a0546c
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="exception_types" optional="true">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The types to be excluded.  Each type or attribute
Chris PeBenito 17de1b
##	must be negated by the caller.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
Chris PeBenito 17de1b
interface(`auth_manage_all_files_except_shadow',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type shadow_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_manage_all_files($1,$2 -shadow_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute utempter programs in the utempter domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift a0546c
##	Domain allowed to transition.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_domtrans_utempter',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type utempter_t, utempter_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 3f67f7
	domtrans_pattern($1, utempter_exec_t, utempter_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute utempter programs in the utempter domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift a0546c
##	Domain allowed to transition.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="role">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The role to allow the utempter domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_run_utempter',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type utempter_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	auth_domtrans_utempter($1)
Chris PeBenito 17de1b
	role $2 types utempter_t;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#######################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Do not audit attemps to execute utempter executable.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain to not audit.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_dontaudit_exec_utempter',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type utempter_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 utempter_exec_t:file { execute execute_no_trans };
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Set the attributes of login record files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_setattr_login_records',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type wtmp_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 wtmp_t:file setattr;
Chris PeBenito 17de1b
	logging_search_logs($1)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read login records files (/var/log/wtmp).
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito bbcd3c
## <rolecap/>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_read_login_records',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type wtmp_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	logging_search_logs($1)
Chris PeBenito c0868a
	allow $1 wtmp_t:file read_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 153ed8
##	Do not audit attempts to read login records
Chris PeBenito 153ed8
##	files (/var/log/wtmp).
Chris PeBenito 153ed8
## </summary>
Chris PeBenito 153ed8
## <param name="domain">
Chris PeBenito 153ed8
##	<summary>
Dominick Grift a0546c
##	Domain to not audit.
Chris PeBenito 153ed8
##	</summary>
Chris PeBenito 153ed8
## </param>
Chris PeBenito 153ed8
## <rolecap/>
Chris PeBenito 153ed8
#
Chris PeBenito 153ed8
interface(`auth_dontaudit_read_login_records',`
Chris PeBenito 153ed8
	gen_require(`
Chris PeBenito 153ed8
		type wtmp_t;
Chris PeBenito 153ed8
	')
Chris PeBenito 153ed8
Chris PeBenito 153ed8
	dontaudit $1 wtmp_t:file read_file_perms;
Chris PeBenito 153ed8
')
Chris PeBenito 153ed8
Chris PeBenito 153ed8
########################################
Chris PeBenito 153ed8
## <summary>
Chris PeBenito 17de1b
##	Do not audit attempts to write to
Chris PeBenito 17de1b
##	login records files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain to not audit.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_dontaudit_write_login_records',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type wtmp_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 wtmp_t:file write;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#######################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Append to login records (wtmp).
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_append_login_records',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type wtmp_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito c0868a
	allow $1 wtmp_t:file append_file_perms;
Chris PeBenito c0868a
	logging_search_logs($1)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#######################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Write to login records (wtmp).
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_write_login_records',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type wtmp_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito c0868a
	allow $1 wtmp_t:file { write_file_perms lock };
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read and write login records.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_rw_login_records',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type wtmp_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 wtmp_t:file rw_file_perms;
Chris PeBenito 17de1b
	logging_search_logs($1)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Create a login records in the log directory
Chris PeBenito 17de1b
##	using a type transition.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_log_filetrans_login_records',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type wtmp_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 3f67f7
	logging_log_filetrans($1, wtmp_t, file)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Create, read, write, and delete login
Chris PeBenito 17de1b
##	records files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_manage_login_records',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type wtmp_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	logging_rw_generic_log_dirs($1)
Chris PeBenito ba1a54
	allow $1 wtmp_t:file manage_file_perms;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito d24a7d
##	Use nsswitch to look up user, password, group, or
Chris PeBenito d24a7d
##	host information.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito d24a7d
## <desc>
Chris PeBenito d24a7d
##	

Chris PeBenito d24a7d
##	Allow the specified domain to look up user, password,
Chris PeBenito d24a7d
##	group, or host information using the name service.
Chris PeBenito d24a7d
##	The most common use of this interface is for services
Chris PeBenito d24a7d
##	that do host name resolution (usually DNS resolution).
Chris PeBenito d24a7d
##	

Chris PeBenito d24a7d
## </desc>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito d24a7d
## <infoflow type="both" weight="10"/>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_use_nsswitch',`
Chris PeBenito 17de1b
Dan Walsh 3eaa99
	allow $1 self:netlink_route_socket r_netlink_socket_perms;
Dan Walsh 3eaa99
Chris PeBenito 17de1b
	files_list_var_lib($1)
Chris PeBenito 17de1b
Chris PeBenito 7d4161
	# read /etc/nsswitch.conf
Chris PeBenito 7d4161
	files_read_etc_files($1)
Chris PeBenito 7d4161
Chris PeBenito 17de1b
	miscfiles_read_certs($1)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	sysnet_dns_name_resolve($1)
Chris PeBenito 17de1b
	sysnet_use_ldap($1)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	optional_policy(`
Chris PeBenito d6d16b
		avahi_stream_connect($1)
Chris PeBenito d6d16b
	')
Chris PeBenito d6d16b
Chris PeBenito 153ed8
	optional_policy(`
Chris PeBenito 153ed8
		ldap_stream_connect($1)
Chris PeBenito 153ed8
	')
Chris PeBenito 153ed8
Dominick Grift 38fc1b
 	optional_policy(`
Dominick Grift 38fc1b
		likewise_stream_connect_lsassd($1)
Dominick Grift 38fc1b
	')
Dominick Grift 38fc1b
Chris PeBenito d6d16b
	optional_policy(`
Chris PeBenito 153ed8
		kerberos_use($1)
Chris PeBenito 153ed8
	')
Chris PeBenito 153ed8
Chris PeBenito 153ed8
	optional_policy(`
Chris PeBenito 17de1b
		nis_use_ypbind($1)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	optional_policy(`
Dan Walsh 3eaa99
		nscd_use($1)
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	optional_policy(`
Dan Walsh 3eaa99
		nslcd_stream_connect($1)
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	optional_policy(`
Dan Walsh 3eaa99
		sssd_stream_connect($1)
Chris PeBenito 3ef029
	')
Chris PeBenito 3ef029
Chris PeBenito 3ef029
	optional_policy(`
Chris PeBenito 17de1b
		samba_stream_connect_winbind($1)
Chris PeBenito 7d4161
		samba_read_var_files($1)
Chris PeBenito 153ed8
		samba_dontaudit_write_var_files($1)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Unconfined access to the authlogin module.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <desc>
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
##	Unconfined access to the authlogin module.
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
##	Currently, this only allows assertions for
Chris PeBenito 17de1b
##	the shadow passwords file (/etc/shadow) to
Chris PeBenito 17de1b
##	be passed.  No access is granted yet.
Chris PeBenito 17de1b
##	

Chris PeBenito 17de1b
## </desc>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`auth_unconfined',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		attribute can_read_shadow_passwords;
Chris PeBenito 17de1b
		attribute can_write_shadow_passwords;
Chris PeBenito 17de1b
		attribute can_relabelto_shadow_passwords;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	typeattribute $1 can_read_shadow_passwords;
Chris PeBenito 17de1b
	typeattribute $1 can_write_shadow_passwords;
Chris PeBenito 17de1b
	typeattribute $1 can_relabelto_shadow_passwords;
Chris PeBenito 17de1b
')