Chris PeBenito dc771f
## <summary>Common policy for authentication and user login.</summary>
Chris PeBenito e181fe
Chris PeBenito b4cd15
#######################################
Chris PeBenito e88003
## <summary>
Chris PeBenito 8ba1bd
##	Common template to create a domain for authentication.
Chris PeBenito e88003
## </summary>
Chris PeBenito e88003
## <desc>
Chris PeBenito e88003
##	

Chris PeBenito e88003
##	This template creates a derived domain which is allowed
Chris PeBenito e88003
##	to authenticate users by using PAM unix_chkpwd support.
Chris PeBenito e88003
##	

Chris PeBenito e88003
## </desc>
Chris PeBenito e88003
## <param name="userdomain_prefix">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito e88003
##	The prefix of the user domain (e.g., user
Chris PeBenito e88003
##	is the prefix for user_t).
Chris PeBenito 885b83
##	</summary>
Chris PeBenito e88003
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 8ba1bd
template(`authlogin_common_auth_domain_template',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		attribute can_read_shadow_passwords;
Chris PeBenito 8ba1bd
		type chkpwd_exec_t, shadow_t;
Chris PeBenito cbc9d6
	')
Chris PeBenito c4890e
Chris PeBenito 493d6c
	type $1_chkpwd_t, can_read_shadow_passwords;
Chris PeBenito c9428d
	domain_type($1_chkpwd_t)
Chris PeBenito c9428d
	domain_entry_file($1_chkpwd_t,chkpwd_exec_t)
Chris PeBenito c4890e
Chris PeBenito cff75c
	allow $1_chkpwd_t self:capability { audit_write audit_control setuid };
Chris PeBenito 0c73cd
	allow $1_chkpwd_t self:process getattr;
Chris PeBenito c4890e
Chris PeBenito 139520
	files_list_etc($1_chkpwd_t)
Chris PeBenito 0c73cd
	allow $1_chkpwd_t shadow_t:file { getattr read };
Chris PeBenito 5c1621
Chris PeBenito 0c73cd
	# is_selinux_enabled
Chris PeBenito 0c73cd
	kernel_read_system_state($1_chkpwd_t)
Chris PeBenito 5c1621
Chris PeBenito cff75c
	dev_read_rand($1_chkpwd_t)
Chris PeBenito cff75c
	dev_read_urand($1_chkpwd_t)
Chris PeBenito cff75c
Chris PeBenito 0fd9dc
	fs_dontaudit_getattr_xattr_fs($1_chkpwd_t)
Chris PeBenito 5c1621
Chris PeBenito c9428d
	libs_use_ld_so($1_chkpwd_t)
Chris PeBenito c9428d
	libs_use_shared_libs($1_chkpwd_t)
Chris PeBenito 5c1621
Chris PeBenito 8fd367
	files_read_etc_files($1_chkpwd_t)
Chris PeBenito 0c73cd
	# for nscd
Chris PeBenito c9428d
	files_dontaudit_search_var($1_chkpwd_t)
Chris PeBenito 5c1621
Chris PeBenito c9428d
	logging_send_syslog_msg($1_chkpwd_t)
Chris PeBenito 5c1621
Chris PeBenito 29ce00
	miscfiles_read_certs($1_chkpwd_t)
Chris PeBenito 0c73cd
	miscfiles_read_localization($1_chkpwd_t)
Chris PeBenito 5c1621
Chris PeBenito 5e0da6
	seutil_read_config($1_chkpwd_t)
Chris PeBenito c4890e
Chris PeBenito 98a8ea
	sysnet_dns_name_resolve($1_chkpwd_t)
Chris PeBenito cff75c
	sysnet_use_ldap($1_chkpwd_t)
Chris PeBenito c4890e
Chris PeBenito bb7170
	optional_policy(`
Chris PeBenito a7a979
		kerberos_use($1_chkpwd_t)
Chris PeBenito a7a979
	')
Chris PeBenito a7a979
Chris PeBenito bb7170
	optional_policy(`
Chris PeBenito ab940a
		nis_use_ypbind($1_chkpwd_t)
Chris PeBenito ab940a
	')
Chris PeBenito ab940a
Chris PeBenito bb7170
	optional_policy(`
Chris PeBenito 1815ba
		nscd_socket_use($1_chkpwd_t)
Chris PeBenito 493d6c
	')
Chris PeBenito 493d6c
Chris PeBenito bb7170
	optional_policy(`
Chris PeBenito 1815ba
		samba_stream_connect_winbind($1_chkpwd_t)
Chris PeBenito 0c73cd
	')
Chris PeBenito 8ba1bd
')
Chris PeBenito 8ba1bd
Chris PeBenito 8ba1bd
#######################################
Chris PeBenito 8ba1bd
## <summary>
Chris PeBenito 8ba1bd
##	The per user domain template for the authlogin module.
Chris PeBenito 8ba1bd
## </summary>
Chris PeBenito 8ba1bd
## <desc>
Chris PeBenito 8ba1bd
##	

Chris PeBenito 8ba1bd
##	This template creates a derived domain which is allowed
Chris PeBenito 8ba1bd
##	to authenticate users by using PAM unix_chkpwd support.
Chris PeBenito 8ba1bd
##	This domain will be used by any programs running in the
Chris PeBenito 8ba1bd
##	user domain which use PAM to authenticate.
Chris PeBenito 8ba1bd
##	

Chris PeBenito 8ba1bd
##	

Chris PeBenito 8ba1bd
##	This template is invoked automatically for each user, and
Chris PeBenito 8ba1bd
##	generally does not need to be invoked directly
Chris PeBenito 8ba1bd
##	by policy writers.
Chris PeBenito 8ba1bd
##	

Chris PeBenito 8ba1bd
## </desc>
Chris PeBenito 8ba1bd
## <param name="userdomain_prefix">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 8ba1bd
##	The prefix of the user domain (e.g., user
Chris PeBenito 8ba1bd
##	is the prefix for user_t).
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 8ba1bd
## </param>
Chris PeBenito 8ba1bd
## <param name="user_domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 8ba1bd
##	The type of the user domain.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 8ba1bd
## </param>
Chris PeBenito 8ba1bd
## <param name="user_role">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 8ba1bd
##	The role associated with the user domain.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 8ba1bd
## </param>
Chris PeBenito 8ba1bd
#
Chris PeBenito 8ba1bd
template(`authlogin_per_userdomain_template',`
Chris PeBenito cff75c
Chris PeBenito 8ba1bd
	gen_require(`
Chris PeBenito 8ba1bd
		type system_chkpwd_t, shadow_t;
Chris PeBenito cff75c
	')
Chris PeBenito 8ba1bd
Chris PeBenito 8ba1bd
	authlogin_common_auth_domain_template($1)
Chris PeBenito 8ba1bd
Chris PeBenito 8ba1bd
	role $3 types $1_chkpwd_t;
Chris PeBenito 8ba1bd
	role $3 types system_chkpwd_t;
Chris PeBenito 8ba1bd
Chris PeBenito 8ba1bd
	allow $2 self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
Chris PeBenito 8ba1bd
Chris PeBenito 8ba1bd
	dontaudit $2 shadow_t:file { getattr read };
Chris PeBenito 8ba1bd
Chris PeBenito 8ba1bd
	# Transition from the user domain to this domain.
Chris PeBenito 8ba1bd
	domain_auto_trans($2,chkpwd_exec_t,$1_chkpwd_t)
Chris PeBenito 8ba1bd
	allow $1_chkpwd_t $2:fd use;
Chris PeBenito 8ba1bd
	allow $2 $1_chkpwd_t:fd use;
Chris PeBenito 8ba1bd
	allow $1_chkpwd_t $2:fifo_file rw_file_perms;
Chris PeBenito 8ba1bd
	allow $1_chkpwd_t $2:process sigchld;
Chris PeBenito 8ba1bd
Chris PeBenito 15722e
	domain_use_interactive_fds($1_chkpwd_t)
Chris PeBenito 8ba1bd
Chris PeBenito 15722e
	seutil_use_newrole_fds($1_chkpwd_t)
Chris PeBenito 8ba1bd
Chris PeBenito 8ba1bd
	# Write to the user domain tty.
Chris PeBenito 8ba1bd
	userdom_use_user_terminals($1,$1_chkpwd_t)
Chris PeBenito a7a979
')
Chris PeBenito c4890e
Chris PeBenito dd8229
########################################
Chris PeBenito 2a9456
## <summary>
Chris PeBenito 2a9456
##	Run unix_chkpwd to check a password
Chris PeBenito 2a9456
##	for a user domain.
Chris PeBenito 2a9456
## </summary>
Chris PeBenito 2a9456
## <desc>
Chris PeBenito 2a9456
##	

Chris PeBenito 2a9456
##	Run unix_chkpwd to check a password
Chris PeBenito 2a9456
##	for a user domain.
Chris PeBenito 2a9456
##	

Chris PeBenito 2a9456
##	

Chris PeBenito 2a9456
##	This is a templated interface, and should only
Chris PeBenito 2a9456
##	be called from a per-userdomain template.
Chris PeBenito 2a9456
##	

Chris PeBenito 2a9456
## </desc>
Chris PeBenito 2a9456
## <param name="userdomain_prefix">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 2a9456
##	The prefix of the user domain (e.g., user
Chris PeBenito 2a9456
##	is the prefix for user_t).
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 2a9456
## </param>
Chris PeBenito 2a9456
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 2a9456
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 2a9456
## </param>
Chris PeBenito 2a9456
#
Chris PeBenito 2a9456
template(`auth_domtrans_user_chk_passwd',`
Chris PeBenito 83e451
	ifdef(`targeted_policy',`
Chris PeBenito 83e451
		gen_require(`
Chris PeBenito 6f81e1
			type system_chkpwd_t, chkpwd_exec_t;
Chris PeBenito 83e451
		')
Chris PeBenito 83e451
Chris PeBenito 83e451
		domain_auto_trans($2,chkpwd_exec_t,system_chkpwd_t)
Chris PeBenito 83e451
		allow $2 system_chkpwd_t:fd use;
Chris PeBenito 83e451
		allow system_chkpwd_t $2:fd use;
Chris PeBenito 83e451
		allow system_chkpwd_t $2:fifo_file rw_file_perms;
Chris PeBenito 83e451
		allow system_chkpwd_t $2:process sigchld;
Chris PeBenito 83e451
	',`
Chris PeBenito 1dd86c
		gen_require(`
Chris PeBenito 4ace0f
			type $1_chkpwd_t, chkpwd_exec_t;
Chris PeBenito 1dd86c
		')
Chris PeBenito 1dd86c
Chris PeBenito 30705b
		corecmd_search_bin($2)
Chris PeBenito 30705b
		domain_auto_trans($2,chkpwd_exec_t,$1_chkpwd_t)
Chris PeBenito 1dd86c
Chris PeBenito 30705b
		allow $2 $1_chkpwd_t:fd use;
Chris PeBenito 30705b
		allow $1_chkpwd_t $2:fd use;
Chris PeBenito 30705b
		allow $1_chkpwd_t $2:fifo_file rw_file_perms;
Chris PeBenito 30705b
		allow $1_chkpwd_t $2:process sigchld;
Chris PeBenito 2a9456
	')
Chris PeBenito 2a9456
')
Chris PeBenito 2a9456
Chris PeBenito 2a9456
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Use the login program as an entry point program.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of process using the login program as entry point.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito 199895
interface(`auth_login_entry_type',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type login_exec_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	domain_entry_file($1,login_exec_t)
Chris PeBenito 07efe9
')
Chris PeBenito 07efe9
Chris PeBenito e7fcdc
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute a login_program in the target domain.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="target_domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the login_program process.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito e7fcdc
#
Chris PeBenito 199895
interface(`auth_domtrans_login_program',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type login_exec_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 7a2f20
	corecmd_search_bin($1)
Chris PeBenito 7a2f20
	domain_auto_trans($1,login_exec_t,$2)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 $2:fd use;
Chris PeBenito 0c73cd
	allow $2 $1:fd use;
Chris PeBenito 0c73cd
	allow $2 $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow $2 $1:process sigchld;
Chris PeBenito e7fcdc
')
Chris PeBenito e7fcdc
Chris PeBenito dd8229
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Run unix_chkpwd to check a password.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito 199895
interface(`auth_domtrans_chk_passwd',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type system_chkpwd_t, chkpwd_exec_t, shadow_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 7a2f20
	corecmd_search_sbin($1)
Chris PeBenito 763c44
	domain_auto_trans($1,chkpwd_exec_t,system_chkpwd_t)
Chris PeBenito 0c73cd
Chris PeBenito cff75c
	allow $1 self:capability { audit_write audit_control };
Chris PeBenito cff75c
	allow $1 self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
Chris PeBenito cff75c
Chris PeBenito 0c73cd
	allow $1 system_chkpwd_t:fd use;
Chris PeBenito 0c73cd
	allow system_chkpwd_t $1:fd use;
Chris PeBenito 0c73cd
	allow system_chkpwd_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow system_chkpwd_t $1:process sigchld;
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 shadow_t:file { getattr read };
Chris PeBenito 0c73cd
Chris PeBenito cff75c
	dev_read_rand($1)
Chris PeBenito cff75c
	dev_read_urand($1)
Chris PeBenito cff75c
Chris PeBenito 29ce00
	miscfiles_read_certs($1)
Chris PeBenito 29ce00
Chris PeBenito 98a8ea
	sysnet_dns_name_resolve($1)
Chris PeBenito cff75c
	sysnet_use_ldap($1)
Chris PeBenito ab940a
Chris PeBenito bb7170
	optional_policy(`
Chris PeBenito a7a979
		kerberos_use($1)
Chris PeBenito a7a979
	')
Chris PeBenito a7a979
Chris PeBenito bb7170
	optional_policy(`
Chris PeBenito ab940a
		nis_use_ypbind($1)
Chris PeBenito ab940a
	')
Chris PeBenito cff75c
Chris PeBenito bb7170
	optional_policy(`
Chris PeBenito 1815ba
		samba_stream_connect_winbind($1)
Chris PeBenito cff75c
	')
Chris PeBenito 0c73cd
')
Chris PeBenito c4890e
Chris PeBenito dd8229
########################################
Chris PeBenito 493d6c
## <summary>
Chris PeBenito 493d6c
##	Get the attributes of the shadow passwords file.
Chris PeBenito 493d6c
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito 493d6c
interface(`auth_getattr_shadow',`
Chris PeBenito 493d6c
	gen_require(`
Chris PeBenito 493d6c
		type shadow_t;
Chris PeBenito 493d6c
	')
Chris PeBenito 493d6c
Chris PeBenito 493d6c
	files_search_etc($1)
Chris PeBenito 493d6c
	allow $1 shadow_t:file getattr;
Chris PeBenito 493d6c
')
Chris PeBenito 493d6c
Chris PeBenito 493d6c
########################################
Chris PeBenito 493d6c
## <summary>
Chris PeBenito 493d6c
##	Do not audit attempts to get the attributes
Chris PeBenito 493d6c
##	of the shadow passwords file.
Chris PeBenito 493d6c
## </summary>
Chris PeBenito 493d6c
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 493d6c
##	Domain to not audit.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 493d6c
## </param>
Chris PeBenito 493d6c
#
Chris PeBenito 199895
interface(`auth_dontaudit_getattr_shadow',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 shadow_t:file getattr;
Chris PeBenito 57440f
')
Chris PeBenito 57440f
Chris PeBenito dd8229
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Read the shadow passwords file (/etc/shadow)
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito bf080a
# cjp: these next three interfaces are split 
Chris PeBenito bf080a
# since typeattribute does not work in conditionals
Chris PeBenito bf080a
# yet, otherwise they should be one interface.
Chris PeBenito bf080a
# 
Chris PeBenito 199895
interface(`auth_read_shadow',`
Chris PeBenito bf080a
	auth_can_read_shadow_passwords($1)
Chris PeBenito bf080a
	auth_tunable_read_shadow($1)
Chris PeBenito bf080a
')
Chris PeBenito bf080a
Chris PeBenito bf080a
interface(`auth_can_read_shadow_passwords',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		attribute can_read_shadow_passwords;
Chris PeBenito bf080a
	')
Chris PeBenito bf080a
Chris PeBenito bf080a
	typeattribute $1 can_read_shadow_passwords;
Chris PeBenito bf080a
')
Chris PeBenito bf080a
Chris PeBenito bf080a
interface(`auth_tunable_read_shadow',`
Chris PeBenito bf080a
	gen_require(`
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_list_etc($1)
Chris PeBenito dd8229
	allow $1 shadow_t:file r_file_perms;
Chris PeBenito c4890e
')
Chris PeBenito c4890e
Chris PeBenito dd8229
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Do not audit attempts to read the shadow
Chris PeBenito 414e41
##	password file (/etc/shadow).
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the domain to not audit.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito 199895
interface(`auth_dontaudit_read_shadow',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 shadow_t:file { getattr read };
Chris PeBenito c4890e
')
Chris PeBenito c4890e
Chris PeBenito dd8229
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Read and write the shadow password file (/etc/shadow).
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito 199895
interface(`auth_rw_shadow',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		attribute can_read_shadow_passwords, can_write_shadow_passwords;
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_list_etc($1)
Chris PeBenito 0c73cd
	allow $1 shadow_t:file rw_file_perms;
Chris PeBenito 0c73cd
	typeattribute $1 can_read_shadow_passwords, can_write_shadow_passwords;
Chris PeBenito c4890e
')
Chris PeBenito c4890e
Chris PeBenito c4890e
#######################################
Chris PeBenito c4890e
#
Chris PeBenito c9428d
# auth_manage_shadow(domain)
Chris PeBenito a1f94a
#
Chris PeBenito 199895
interface(`auth_manage_shadow',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		attribute can_read_shadow_passwords, can_write_shadow_passwords;
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 shadow_t:file create_file_perms;
Chris PeBenito 103fe2
	files_etc_filetrans($1,shadow_t,file)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	typeattribute $1 can_read_shadow_passwords, can_write_shadow_passwords;
Chris PeBenito a1f94a
')
Chris PeBenito a1f94a
Chris PeBenito a1f94a
#######################################
Chris PeBenito 2629c6
## <summary>
Chris PeBenito 2629c6
##	Relabel to the shadow
Chris PeBenito 2629c6
##	password file type.
Chris PeBenito 2629c6
## </summary>
Chris PeBenito 2629c6
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 2629c6
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 2629c6
## </param>
Chris PeBenito a1f94a
#
Chris PeBenito 199895
interface(`auth_relabelto_shadow',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		attribute can_relabelto_shadow_passwords;
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_etc($1)
Chris PeBenito 0c73cd
	allow $1 shadow_t:file relabelto;
Chris PeBenito 0c73cd
	typeattribute $1 can_relabelto_shadow_passwords;
Chris PeBenito a1f94a
')
Chris PeBenito a1f94a
Chris PeBenito a1f94a
#######################################
Chris PeBenito cf6a7d
## <summary>
Chris PeBenito 2629c6
##	Relabel from and to the shadow
Chris PeBenito 2629c6
##	password file type.
Chris PeBenito 2629c6
## </summary>
Chris PeBenito 2629c6
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 2629c6
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 2629c6
## </param>
Chris PeBenito 2629c6
#
Chris PeBenito 2629c6
interface(`auth_relabel_shadow',`
Chris PeBenito 2629c6
	gen_require(`
Chris PeBenito 2629c6
		attribute can_relabelto_shadow_passwords;
Chris PeBenito 2629c6
		type shadow_t;
Chris PeBenito 2629c6
	')
Chris PeBenito 2629c6
Chris PeBenito 2629c6
	files_search_etc($1)
Chris PeBenito 2629c6
	allow $1 shadow_t:file { relabelfrom relabelto };
Chris PeBenito 2629c6
	typeattribute $1 can_relabelto_shadow_passwords;
Chris PeBenito 2629c6
')
Chris PeBenito 2629c6
Chris PeBenito 2629c6
#######################################
Chris PeBenito 2629c6
## <summary>
Chris PeBenito cf6a7d
##	Append to the login failure log.
Chris PeBenito cf6a7d
## </summary>
Chris PeBenito cf6a7d
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito cf6a7d
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito cf6a7d
## </param>
Chris PeBenito cf6a7d
#
Chris PeBenito cf6a7d
interface(`auth_append_faillog',`
Chris PeBenito cf6a7d
	gen_require(`
Chris PeBenito cf6a7d
		type faillog_t;
Chris PeBenito cf6a7d
	')
Chris PeBenito cf6a7d
Chris PeBenito cf6a7d
	logging_search_logs($1)
Chris PeBenito cf6a7d
	allow $1 faillog_t:file { getattr append };
Chris PeBenito cf6a7d
')
Chris PeBenito cf6a7d
Chris PeBenito cf6a7d
#######################################
Chris PeBenito a1f94a
#
Chris PeBenito c9428d
# auth_rw_faillog(domain)
Chris PeBenito 4bf4ed
#
Chris PeBenito 199895
interface(`auth_rw_faillog',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type faillog_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	logging_search_logs($1)
Chris PeBenito 7a2f20
	allow $1 faillog_t:file rw_file_perms;
Chris PeBenito 4bf4ed
')
Chris PeBenito 4bf4ed
Chris PeBenito 4bf4ed
#######################################
Chris PeBenito d4dca5
## <summary>
Chris PeBenito d4dca5
##	Read the last logins log.
Chris PeBenito d4dca5
## </summary>
Chris PeBenito d4dca5
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito d4dca5
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito d4dca5
## </param>
Chris PeBenito 4bf4ed
#
Chris PeBenito d4dca5
interface(`auth_read_lastlog',`
Chris PeBenito d4dca5
	gen_require(`
Chris PeBenito d4dca5
		type lastlog_t;
Chris PeBenito d4dca5
	')
Chris PeBenito d4dca5
Chris PeBenito d4dca5
	logging_search_logs($1)
Chris PeBenito d4dca5
	allow $1 lastlog_t:file { getattr read };
Chris PeBenito d4dca5
')
Chris PeBenito d4dca5
Chris PeBenito d4dca5
#######################################
Chris PeBenito d4dca5
## <summary>
Chris PeBenito de7649
##	Append only to the last logins log.
Chris PeBenito de7649
## </summary>
Chris PeBenito de7649
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito de7649
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito de7649
## </param>
Chris PeBenito de7649
#
Chris PeBenito de7649
interface(`auth_append_lastlog',`
Chris PeBenito de7649
	gen_require(`
Chris PeBenito de7649
		type lastlog_t;
Chris PeBenito de7649
	')
Chris PeBenito de7649
Chris PeBenito de7649
	logging_search_logs($1)
Chris PeBenito de7649
	allow $1 lastlog_t:file { getattr lock append };
Chris PeBenito de7649
')
Chris PeBenito de7649
Chris PeBenito de7649
#######################################
Chris PeBenito de7649
## <summary>
Chris PeBenito d4dca5
##	Read and write to the last logins log.
Chris PeBenito d4dca5
## </summary>
Chris PeBenito d4dca5
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito d4dca5
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito d4dca5
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`auth_rw_lastlog',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type lastlog_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	logging_search_logs($1)
Chris PeBenito 0c73cd
	allow $1 lastlog_t:file { getattr read write setattr };
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito dc771f
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute pam programs in the pam domain.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito 1e5c2a
#
Chris PeBenito 199895
interface(`auth_domtrans_pam',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_t, pam_exec_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito dd8229
	domain_auto_trans($1,pam_exec_t,pam_t)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 pam_t:fd use;
Chris PeBenito 0c73cd
	allow pam_t $1:fd use;
Chris PeBenito 0c73cd
	allow pam_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow pam_t $1:process sigchld;
Chris PeBenito 1e5c2a
')
Chris PeBenito 1e5c2a
Chris PeBenito dc771f
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute pam programs in the PAM domain.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="role">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The role to allow the PAM domain.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="terminal">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the terminal allow the PAM domain to use.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito dc771f
#
Chris PeBenito 199895
interface(`auth_run_pam',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	auth_domtrans_pam($1)
Chris PeBenito 0c73cd
	role $2 types pam_t;
Chris PeBenito dd8229
	allow pam_t $3:chr_file rw_file_perms;
Chris PeBenito dc771f
')
Chris PeBenito dc771f
Chris PeBenito dd8229
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute the pam program.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito 199895
interface(`auth_exec_pam',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_exec_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 0fd9dc
	can_exec($1,pam_exec_t)
Chris PeBenito 1e5c2a
')
Chris PeBenito 1e5c2a
Chris PeBenito 7c2f5a
########################################
Chris PeBenito 7c2f5a
## <summary>
Chris PeBenito 7c2f5a
##	Manage var auth files. Used by various other applications
Chris PeBenito 7c2f5a
##	and pam applets etc.
Chris PeBenito 7c2f5a
## </summary>
Chris PeBenito 7c2f5a
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 7c2f5a
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 7c2f5a
## </param>
Chris PeBenito 7c2f5a
#
Chris PeBenito 7c2f5a
interface(`auth_manage_var_auth',`
Chris PeBenito 7c2f5a
	gen_require(`
Chris PeBenito 7c2f5a
		type var_auth_t;
Chris PeBenito 7c2f5a
	')
Chris PeBenito 7c2f5a
Chris PeBenito 7c2f5a
	files_search_var($1)
Chris PeBenito 7c2f5a
	allow $1 var_auth_t:dir create_dir_perms;
Chris PeBenito 7c2f5a
	allow $1 var_auth_t:file rw_file_perms;
Chris PeBenito 7c2f5a
	allow $1 var_auth_t:lnk_file rw_file_perms;
Chris PeBenito 7c2f5a
')
Chris PeBenito 7c2f5a
Chris PeBenito 1e5c2a
#######################################
Chris PeBenito 1e5c2a
#
Chris PeBenito c9428d
# auth_read_pam_pid(domain)
Chris PeBenito dfaf6c
#
Chris PeBenito 199895
interface(`auth_read_pam_pid',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_var_run_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito c9428d
	files_search_pids($1)
Chris PeBenito dd8229
	allow $1 pam_var_run_t:dir r_dir_perms;
Chris PeBenito dd8229
	allow $1 pam_var_run_t:file r_file_perms;
Chris PeBenito dfaf6c
')
Chris PeBenito dfaf6c
Chris PeBenito 9fd4b8
#######################################
Chris PeBenito 9fd4b8
## <summary>
Chris PeBenito 9fd4b8
##	Do not audit attemps to read PAM pid files.
Chris PeBenito 9fd4b8
## </summary>
Chris PeBenito 9fd4b8
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 9fd4b8
##	Domain to not audit.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 9fd4b8
## </param>
Chris PeBenito 9fd4b8
#
Chris PeBenito 9fd4b8
interface(`auth_dontaudit_read_pam_pid',`
Chris PeBenito 9fd4b8
	gen_require(`
Chris PeBenito 9fd4b8
		type pam_var_run_t;
Chris PeBenito 9fd4b8
	')
Chris PeBenito 9fd4b8
Chris PeBenito 9fd4b8
	dontaudit $1 pam_var_run_t:file { getattr read };
Chris PeBenito 9fd4b8
')
Chris PeBenito 9fd4b8
Chris PeBenito dd8229
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Delete pam PID files.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito 199895
interface(`auth_delete_pam_pid',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_var_run_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito c9428d
	files_search_pids($1)
Chris PeBenito 0c73cd
	allow $1 pam_var_run_t:dir { getattr search read write remove_name };
Chris PeBenito 0c73cd
	allow $1 pam_var_run_t:file { getattr unlink };
Chris PeBenito 3ce6cb
')
Chris PeBenito 3ce6cb
Chris PeBenito 7c2f5a
########################################
Chris PeBenito 7c2f5a
## <summary>
Chris PeBenito 7c2f5a
##	Manage pam PID files.
Chris PeBenito 7c2f5a
## </summary>
Chris PeBenito 7c2f5a
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 7c2f5a
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 7c2f5a
## </param>
Chris PeBenito 7c2f5a
#
Chris PeBenito 7c2f5a
interface(`auth_manage_pam_pid',`
Chris PeBenito 7c2f5a
	gen_require(`
Chris PeBenito 7c2f5a
		type pam_var_run_t;
Chris PeBenito 7c2f5a
	')
Chris PeBenito 7c2f5a
Chris PeBenito 7c2f5a
	files_search_pids($1)
Chris PeBenito 7c2f5a
	allow $1 pam_var_run_t:dir create_dir_perms;
Chris PeBenito 7c2f5a
	allow $1 pam_var_run_t:file create_file_perms;
Chris PeBenito 7c2f5a
')
Chris PeBenito 7c2f5a
Chris PeBenito 1e5c2a
#######################################
Chris PeBenito 1e5c2a
#
Chris PeBenito c9428d
# auth_domtrans_pam_console(domain)
Chris PeBenito 1e5c2a
#
Chris PeBenito 199895
interface(`auth_domtrans_pam_console',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_console_t, pam_console_exec_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito dd8229
	domain_auto_trans($1,pam_console_exec_t,pam_console_t)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 pam_console_t:fd use;
Chris PeBenito 0c73cd
	allow pam_console_t $1:fd use;
Chris PeBenito 0c73cd
	allow pam_console_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow pam_console_t $1:process sigchld;
Chris PeBenito 1e5c2a
')
Chris PeBenito 1e5c2a
Chris PeBenito ac9aa2
########################################
Chris PeBenito ac9aa2
## <summary>
Chris PeBenito ac9aa2
##	Search the contents of the
Chris PeBenito ac9aa2
##	pam_console data directory.
Chris PeBenito ac9aa2
## </summary>
Chris PeBenito ac9aa2
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito ac9aa2
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito ac9aa2
## </param>
Chris PeBenito ac9aa2
#
Chris PeBenito ac9aa2
interface(`auth_search_pam_console_data',`
Chris PeBenito ac9aa2
	gen_require(`
Chris PeBenito ac9aa2
		type pam_var_console_t;
Chris PeBenito ac9aa2
	')
Chris PeBenito ac9aa2
Chris PeBenito ac9aa2
	files_search_var($1)
Chris PeBenito ac9aa2
	files_search_pids($1)
Chris PeBenito ac9aa2
	allow $1 pam_var_console_t:dir search_dir_perms;
Chris PeBenito ac9aa2
')
Chris PeBenito ac9aa2
Chris PeBenito 1e5c2a
#######################################
Chris PeBenito 1e5c2a
#
Chris PeBenito c9428d
# auth_list_pam_console_data(domain)
Chris PeBenito f5c42b
#
Chris PeBenito 199895
interface(`auth_list_pam_console_data',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_var_console_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito c9428d
	files_search_pids($1)
Chris PeBenito 0c73cd
	allow $1 pam_var_console_t:dir r_dir_perms;
Chris PeBenito f5c42b
')
Chris PeBenito f5c42b
Chris PeBenito f5c42b
#######################################
Chris PeBenito f5c42b
#
Chris PeBenito c9428d
# auth_read_pam_console_data(domain)
Chris PeBenito 1e5c2a
#
Chris PeBenito 199895
interface(`auth_read_pam_console_data',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_var_console_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito c9428d
	files_search_pids($1)
Chris PeBenito 0c73cd
	allow $1 pam_var_console_t:dir r_dir_perms;
Chris PeBenito 0c73cd
	allow $1 pam_var_console_t:file r_file_perms;
Chris PeBenito 1e5c2a
')
Chris PeBenito 1e5c2a
Chris PeBenito 1e5c2a
#######################################
Chris PeBenito 1e5c2a
#
Chris PeBenito c9428d
# auth_manage_pam_console_data(domain)
Chris PeBenito 1e5c2a
#
Chris PeBenito 199895
interface(`auth_manage_pam_console_data',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_var_console_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito c9428d
	files_search_pids($1)
Chris PeBenito dd8229
	allow $1 pam_var_console_t:dir rw_dir_perms;
Chris PeBenito 0fd9dc
	allow $1 pam_var_console_t:file create_file_perms;
Chris PeBenito dd8229
	allow $1 pam_var_console_t:lnk_file create_lnk_perms;
Chris PeBenito 1e5c2a
')
Chris PeBenito 1e5c2a
Chris PeBenito a1fcff
#######################################
Chris PeBenito a1fcff
## <summary>
Chris PeBenito a1fcff
##	Delete pam_console data.
Chris PeBenito a1fcff
## </summary>
Chris PeBenito a1fcff
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito a1fcff
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito a1fcff
## </param>
Chris PeBenito a1fcff
#
Chris PeBenito a1fcff
interface(`auth_delete_pam_console_data',`
Chris PeBenito a1fcff
	gen_require(`
Chris PeBenito a1fcff
		type pam_var_console_t;
Chris PeBenito a1fcff
	')
Chris PeBenito a1fcff
Chris PeBenito a1fcff
	files_search_var($1)
Chris PeBenito a1fcff
	files_search_pids($1)
Chris PeBenito a1fcff
	allow $1 pam_var_console_t:dir rw_dir_perms;
Chris PeBenito a1fcff
	allow $1 pam_var_console_t:file unlink;
Chris PeBenito a1fcff
')
Chris PeBenito a1fcff
Chris PeBenito dc771f
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 43989f
##	Read all directories on the filesystem, except
Chris PeBenito 43989f
##	the shadow passwords and listed exceptions.
Chris PeBenito 43989f
## </summary>
Chris PeBenito 43989f
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 43989f
##	The type of the domain perfoming this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 43989f
## </param>
Chris PeBenito 43989f
## <param name="exception_types" optional="true">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 43989f
##	The types to be excluded.  Each type or attribute
Chris PeBenito 43989f
##	must be negated by the caller.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 43989f
## </param>
Chris PeBenito 43989f
#
Chris PeBenito 43989f
interface(`auth_read_all_dirs_except_shadow',`
Chris PeBenito 43989f
	gen_require(`
Chris PeBenito 43989f
		type shadow_t;
Chris PeBenito 43989f
	')
Chris PeBenito 43989f
Chris PeBenito 43989f
	files_read_all_dirs_except($1,$2 -shadow_t)
Chris PeBenito 43989f
')
Chris PeBenito 43989f
Chris PeBenito 43989f
########################################
Chris PeBenito 43989f
## <summary>
Chris PeBenito 43989f
##	Read all files on the filesystem, except
Chris PeBenito 43989f
##	the shadow passwords and listed exceptions.
Chris PeBenito 43989f
## </summary>
Chris PeBenito 43989f
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 43989f
##	The type of the domain perfoming this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 43989f
## </param>
Chris PeBenito 43989f
## <param name="exception_types" optional="true">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 43989f
##	The types to be excluded.  Each type or attribute
Chris PeBenito 43989f
##	must be negated by the caller.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 43989f
## </param>
Chris PeBenito 43989f
#
Chris PeBenito 43989f
interface(`auth_read_all_files_except_shadow',`
Chris PeBenito 43989f
	gen_require(`
Chris PeBenito 43989f
		type shadow_t;
Chris PeBenito 43989f
	')
Chris PeBenito 43989f
Chris PeBenito 43989f
	files_read_all_files_except($1,$2 -shadow_t)
Chris PeBenito 43989f
')
Chris PeBenito 43989f
Chris PeBenito 43989f
########################################
Chris PeBenito 43989f
## <summary>
Chris PeBenito 43989f
##	Read all symbolic links on the filesystem, except
Chris PeBenito 43989f
##	the shadow passwords and listed exceptions.
Chris PeBenito 43989f
## </summary>
Chris PeBenito 43989f
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 43989f
##	The type of the domain perfoming this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 43989f
## </param>
Chris PeBenito 43989f
## <param name="exception_types" optional="true">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 43989f
##	The types to be excluded.  Each type or attribute
Chris PeBenito 43989f
##	must be negated by the caller.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 43989f
## </param>
Chris PeBenito 43989f
#
Chris PeBenito 43989f
interface(`auth_read_all_symlinks_except_shadow',`
Chris PeBenito 43989f
	gen_require(`
Chris PeBenito 43989f
		type shadow_t;
Chris PeBenito 43989f
	')
Chris PeBenito 43989f
Chris PeBenito 43989f
	files_read_all_symlinks_except($1,$2 -shadow_t)
Chris PeBenito 43989f
')
Chris PeBenito 43989f
Chris PeBenito 43989f
########################################
Chris PeBenito 43989f
## <summary>
Chris PeBenito 414e41
##	Relabel all files on the filesystem, except
Chris PeBenito 414e41
##	the shadow passwords and listed exceptions.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the domain perfoming this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="exception_types" optional="true">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The types to be excluded.  Each type or attribute
Chris PeBenito 414e41
##	must be negated by the caller.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito efd8ed
#
Chris PeBenito efd8ed
Chris PeBenito 199895
interface(`auth_relabel_all_files_except_shadow',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	files_relabel_all_files($1,$2 -shadow_t)
Chris PeBenito efd8ed
')
Chris PeBenito efd8ed
Chris PeBenito efd8ed
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Manage all files on the filesystem, except
Chris PeBenito 414e41
##	the shadow passwords and listed exceptions.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the domain perfoming this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="exception_types" optional="true">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The types to be excluded.  Each type or attribute
Chris PeBenito 414e41
##	must be negated by the caller.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito efd8ed
#
Chris PeBenito efd8ed
Chris PeBenito 199895
interface(`auth_manage_all_files_except_shadow',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	files_manage_all_files($1,$2 -shadow_t)
Chris PeBenito efd8ed
')
Chris PeBenito efd8ed
Chris PeBenito efd8ed
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute utempter programs in the utempter domain.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito dc771f
#
Chris PeBenito 199895
interface(`auth_domtrans_utempter',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type utempter_t, utempter_exec_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito dd8229
	domain_auto_trans($1,utempter_exec_t,utempter_t)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 utempter_t:fd use;
Chris PeBenito 0c73cd
	allow utempter_t $1:fd use;
Chris PeBenito 0c73cd
	allow utempter_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow utempter_t $1:process sigchld;
Chris PeBenito dc771f
')
Chris PeBenito dc771f
Chris PeBenito dc771f
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute utempter programs in the utempter domain.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="role">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The role to allow the utempter domain.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="terminal">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the terminal allow the utempter domain to use.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito dc771f
#
Chris PeBenito 199895
interface(`auth_run_utempter',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type utempter_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	auth_domtrans_utempter($1)
Chris PeBenito 0c73cd
	role $2 types utempter_t;
Chris PeBenito dd8229
	allow utempter_t $3:chr_file rw_file_perms;
Chris PeBenito dc771f
')
Chris PeBenito dc771f
Chris PeBenito b16c6b
#######################################
Chris PeBenito c8ba68
## <summary>
Chris PeBenito c8ba68
##	Do not audit attemps to execute utempter executable.
Chris PeBenito c8ba68
## </summary>
Chris PeBenito c8ba68
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito c8ba68
##	Domain to not audit.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito c8ba68
## </param>
Chris PeBenito c8ba68
#
Chris PeBenito c8ba68
interface(`auth_dontaudit_exec_utempter',`
Chris PeBenito c8ba68
	gen_require(`
Chris PeBenito c8ba68
		type utempter_exec_t;
Chris PeBenito c8ba68
	')
Chris PeBenito c8ba68
Chris PeBenito c8ba68
	dontaudit $1 utempter_exec_t:file { execute execute_no_trans };
Chris PeBenito c8ba68
')
Chris PeBenito c8ba68
Chris PeBenito c8ba68
#######################################
Chris PeBenito b16c6b
#
Chris PeBenito 93727e
# auth_setattr_login_records(domain)
Chris PeBenito 93727e
#
Chris PeBenito 93727e
interface(`auth_setattr_login_records',`
Chris PeBenito 93727e
	gen_require(`
Chris PeBenito 93727e
		type wtmp_t;
Chris PeBenito 93727e
	')
Chris PeBenito 93727e
Chris PeBenito 93727e
	allow $1 wtmp_t:file setattr;
Chris PeBenito 93727e
	logging_search_logs($1)
Chris PeBenito 93727e
')
Chris PeBenito 93727e
Chris PeBenito 93727e
#######################################
Chris PeBenito 93727e
#
Chris PeBenito c9428d
# auth_read_login_records(domain)
Chris PeBenito b16c6b
#
Chris PeBenito 199895
interface(`auth_read_login_records',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type wtmp_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	logging_search_logs($1)
Chris PeBenito dd8229
	allow $1 wtmp_t:file r_file_perms;
Chris PeBenito b16c6b
')
Chris PeBenito b16c6b
Chris PeBenito b16c6b
#######################################
Chris PeBenito b16c6b
#
Chris PeBenito c9428d
# auth_dontaudit_write_login_records(domain)
Chris PeBenito b16c6b
#
Chris PeBenito 199895
interface(`auth_dontaudit_write_login_records',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type wtmp_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 wtmp_t:file write;
Chris PeBenito b16c6b
')
Chris PeBenito b16c6b
Chris PeBenito b16c6b
#######################################
Chris PeBenito fc6524
## <summary>
Chris PeBenito fc6524
##	Append to login records (wtmp).
Chris PeBenito fc6524
## </summary>
Chris PeBenito fc6524
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito fc6524
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito fc6524
## </param>
Chris PeBenito fc6524
#
Chris PeBenito fc6524
interface(`auth_append_login_records',`
Chris PeBenito fc6524
	gen_require(`
Chris PeBenito fc6524
		type wtmp_t;
Chris PeBenito fc6524
	')
Chris PeBenito fc6524
Chris PeBenito fc6524
	allow $1 wtmp_t:file { getattr append };
Chris PeBenito fc6524
')
Chris PeBenito fc6524
Chris PeBenito fc6524
#######################################
Chris PeBenito fc6524
## <summary>
Chris PeBenito fc6524
##	Write to login records (wtmp).
Chris PeBenito fc6524
## </summary>
Chris PeBenito fc6524
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito fc6524
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito fc6524
## </param>
Chris PeBenito fc6524
#
Chris PeBenito fc6524
interface(`auth_write_login_records',`
Chris PeBenito fc6524
	gen_require(`
Chris PeBenito fc6524
		type wtmp_t;
Chris PeBenito fc6524
	')
Chris PeBenito fc6524
Chris PeBenito fc6524
	allow $1 wtmp_t:file { write lock };
Chris PeBenito fc6524
')
Chris PeBenito fc6524
Chris PeBenito fc6524
#######################################
Chris PeBenito b16c6b
#
Chris PeBenito c9428d
# auth_rw_login_records(domain)
Chris PeBenito b16c6b
#
Chris PeBenito 199895
interface(`auth_rw_login_records',`
Chris PeBenito 0e7216
	gen_require(`
Chris PeBenito 0e7216
		type wtmp_t;
Chris PeBenito 0e7216
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 wtmp_t:file rw_file_perms;
Chris PeBenito c9428d
	logging_search_logs($1)
Chris PeBenito b16c6b
')
Chris PeBenito b16c6b
Chris PeBenito 96ce00
#######################################
Chris PeBenito 96ce00
#
Chris PeBenito 103fe2
# auth_log_filetrans_login_records(domain)
Chris PeBenito 9a66d4
#
Chris PeBenito 103fe2
interface(`auth_log_filetrans_login_records',`
Chris PeBenito 9a66d4
	gen_require(`
Chris PeBenito 9a66d4
		type wtmp_t;
Chris PeBenito 9a66d4
	')
Chris PeBenito 9a66d4
Chris PeBenito 103fe2
	logging_log_filetrans($1,wtmp_t,file)
Chris PeBenito 9a66d4
')
Chris PeBenito 9a66d4
Chris PeBenito 9a66d4
#######################################
Chris PeBenito 9a66d4
#
Chris PeBenito 96ce00
# auth_manage_login_records(domain)
Chris PeBenito 96ce00
#
Chris PeBenito 96ce00
interface(`auth_manage_login_records',`
Chris PeBenito 96ce00
	gen_require(`
Chris PeBenito 96ce00
		type wtmp_t;
Chris PeBenito 96ce00
	')
Chris PeBenito 96ce00
Chris PeBenito 1815ba
	logging_rw_generic_log_dirs($1)
Chris PeBenito 96ce00
	allow $1 wtmp_t:file create_file_perms;
Chris PeBenito 96ce00
')
Chris PeBenito 8b0bbd
Chris PeBenito 8b0bbd
########################################
Chris PeBenito 8b0bbd
## <summary>
Chris PeBenito 77f6e2
##	Use nsswitch to look up uid-username mappings.
Chris PeBenito 77f6e2
## </summary>
Chris PeBenito 77f6e2
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 77f6e2
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 77f6e2
## </param>
Chris PeBenito 77f6e2
#
Chris PeBenito 77f6e2
interface(`auth_use_nsswitch',`
Chris PeBenito 7b062e
	gen_require(`
Chris PeBenito 7b062e
		type var_auth_t;
Chris PeBenito 7b062e
	')
Chris PeBenito 7b062e
Chris PeBenito 7b062e
	allow $1 var_auth_t:dir r_dir_perms;
Chris PeBenito 7b062e
	allow $1 var_auth_t:file create_file_perms;
Chris PeBenito 95f82b
	files_list_var_lib($1)
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
	sysnet_dns_name_resolve($1)
Chris PeBenito 77f6e2
	sysnet_use_ldap($1)
Chris PeBenito 77f6e2
Chris PeBenito bb7170
	optional_policy(`
Chris PeBenito 77f6e2
		nis_use_ypbind($1)
Chris PeBenito 77f6e2
	')
Chris PeBenito 77f6e2
Chris PeBenito bb7170
	optional_policy(`
Chris PeBenito 1815ba
		samba_stream_connect_winbind($1)
Chris PeBenito 77f6e2
	')
Chris PeBenito 77f6e2
')
Chris PeBenito 77f6e2
Chris PeBenito 77f6e2
########################################
Chris PeBenito 77f6e2
## <summary>
Chris PeBenito 8b0bbd
##	Unconfined access to the authlogin module.
Chris PeBenito 8b0bbd
## </summary>
Chris PeBenito 8b0bbd
## <desc>
Chris PeBenito 8b0bbd
##	

Chris PeBenito 8b0bbd
##	Unconfined access to the authlogin module.
Chris PeBenito 8b0bbd
##	

Chris PeBenito 8b0bbd
##	

Chris PeBenito 8b0bbd
##	Currently, this only allows assertions for
Chris PeBenito 8b0bbd
##	the shadow passwords file (/etc/shadow) to
Chris PeBenito 8b0bbd
##	be passed.  No access is granted yet.
Chris PeBenito 8b0bbd
##	

Chris PeBenito 8b0bbd
## </desc>
Chris PeBenito 8b0bbd
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 8b0bbd
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 8b0bbd
## </param>
Chris PeBenito 8b0bbd
#
Chris PeBenito 8b0bbd
interface(`auth_unconfined',`
Chris PeBenito 8b0bbd
	gen_require(`
Chris PeBenito 8b0bbd
		attribute can_read_shadow_passwords;
Chris PeBenito 8b0bbd
		attribute can_write_shadow_passwords;
Chris PeBenito 8b0bbd
		attribute can_relabelto_shadow_passwords;
Chris PeBenito 8b0bbd
	')
Chris PeBenito 8b0bbd
Chris PeBenito 8b0bbd
	typeattribute $1 can_read_shadow_passwords;
Chris PeBenito 8b0bbd
	typeattribute $1 can_write_shadow_passwords;
Chris PeBenito 8b0bbd
	typeattribute $1 can_relabelto_shadow_passwords;
Chris PeBenito 8b0bbd
')