Chris PeBenito 17de1b
## <summary>Policy for local logins.</summary>
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute local logins in the local login domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The type of the process performing this action.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`locallogin_domtrans',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type local_login_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 3f67f7
	auth_domtrans_login_program($1, local_login_t)
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mcs',`
Chris PeBenito 3f67f7
		auth_ranged_domtrans_login_program($1, local_login_t, s0 - mcs_systemhigh)
Chris PeBenito e070dd
	')
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Allow processes to inherit local login file descriptors.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The type of the process performing this action.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`locallogin_use_fds',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type local_login_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 local_login_t:fd use;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Do not audit attempts to inherit local login file descriptors.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain to not audit.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`locallogin_dontaudit_use_fds',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type local_login_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 local_login_t:fd use;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Send a null signal to local login processes.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`locallogin_signull',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type local_login_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow $1 local_login_t:process signull;
Chris PeBenito 17de1b
')
Chris PeBenito d6d16b
Chris PeBenito d6d16b
########################################
Chris PeBenito d6d16b
## <summary>
Chris PeBenito d6d16b
##	Search for key.
Chris PeBenito d6d16b
## </summary>
Chris PeBenito d6d16b
## <param name="domain">
Chris PeBenito d6d16b
##	<summary>
Chris PeBenito d6d16b
##	Domain allowed access.
Chris PeBenito d6d16b
##	</summary>
Chris PeBenito d6d16b
## </param>
Chris PeBenito d6d16b
#
Chris PeBenito d6d16b
interface(`locallogin_search_keys',`
Chris PeBenito d6d16b
	gen_require(`
Chris PeBenito d6d16b
		type local_login_t;
Chris PeBenito d6d16b
	')
Chris PeBenito d6d16b
Chris PeBenito d6d16b
	allow $1 local_login_t:key search;
Chris PeBenito d6d16b
')
Chris PeBenito d6d16b
Chris PeBenito d6d16b
########################################
Chris PeBenito d6d16b
## <summary>
Chris PeBenito d6d16b
##	Allow link to the local_login key ring.
Chris PeBenito d6d16b
## </summary>
Chris PeBenito d6d16b
## <param name="domain">
Chris PeBenito d6d16b
##	<summary>
Chris PeBenito d6d16b
##	Domain allowed access.
Chris PeBenito d6d16b
##	</summary>
Chris PeBenito d6d16b
## </param>
Chris PeBenito d6d16b
#
Chris PeBenito d6d16b
interface(`locallogin_link_keys',`
Chris PeBenito d6d16b
	gen_require(`
Chris PeBenito d6d16b
		type local_login_t;
Chris PeBenito d6d16b
	')
Chris PeBenito d6d16b
Chris PeBenito d6d16b
	allow $1 local_login_t:key link;
Chris PeBenito d6d16b
')
Chris PeBenito d46cfe
Chris PeBenito d46cfe
########################################
Chris PeBenito d46cfe
## <summary>
Chris PeBenito d46cfe
##	Execute local logins in the local login domain.
Chris PeBenito d46cfe
## </summary>
Chris PeBenito d46cfe
## <param name="domain">
Chris PeBenito d46cfe
##	<summary>
Chris PeBenito d46cfe
##	Domain allowed access.
Chris PeBenito d46cfe
##	</summary>
Chris PeBenito d46cfe
## </param>
Chris PeBenito d46cfe
#
Chris PeBenito d46cfe
interface(`locallogin_domtrans_sulogin',`
Chris PeBenito d46cfe
	gen_require(`
Chris PeBenito d46cfe
		type sulogin_exec_t, sulogin_t;
Chris PeBenito d46cfe
	')
Chris PeBenito d46cfe
Chris PeBenito 3f67f7
	domtrans_pattern($1, sulogin_exec_t, sulogin_t)
Chris PeBenito d46cfe
')