Chris PeBenito dc771f
## <summary>Common policy for authentication and user login.</summary>
Chris PeBenito e181fe
Chris PeBenito b4cd15
#######################################
Chris PeBenito e88003
## <summary>
Chris PeBenito e88003
##	The per user domain template for the authlogin module.
Chris PeBenito e88003
## </summary>
Chris PeBenito e88003
## <desc>
Chris PeBenito e88003
##	

Chris PeBenito e88003
##	This template creates a derived domain which is allowed
Chris PeBenito e88003
##	to authenticate users by using PAM unix_chkpwd support.
Chris PeBenito e88003
##	This domain will be used by any programs running in the
Chris PeBenito e88003
##	user domain which use PAM to authenticate.
Chris PeBenito e88003
##	

Chris PeBenito e88003
##	

Chris PeBenito e88003
##	This template is invoked automatically for each user, and
Chris PeBenito e88003
##	generally does not need to be invoked directly
Chris PeBenito e88003
##	by policy writers.
Chris PeBenito e88003
##	

Chris PeBenito e88003
## </desc>
Chris PeBenito e88003
## <param name="userdomain_prefix">
Chris PeBenito e88003
##	The prefix of the user domain (e.g., user
Chris PeBenito e88003
##	is the prefix for user_t).
Chris PeBenito e88003
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito e88003
template(`authlogin_per_userdomain_template',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		attribute can_read_shadow_passwords;
Chris PeBenito cbc9d6
		type chkpwd_exec_t, system_chkpwd_t, shadow_t;
Chris PeBenito cbc9d6
		class file rx_file_perms;
Chris PeBenito cbc9d6
		class process { getattr transition sigchld };
Chris PeBenito cbc9d6
		class capability setuid;
Chris PeBenito cbc9d6
		class unix_stream_socket { create read getattr write setattr append bind connect getopt setopt shutdown }; 
Chris PeBenito cbc9d6
		class unix_dgram_socket { create read getattr write setattr append bind connect getopt setopt shutdown };
Chris PeBenito cbc9d6
		class fd use;
Chris PeBenito cbc9d6
		class fifo_file rw_file_perms;
Chris PeBenito cbc9d6
	')
Chris PeBenito c4890e
Chris PeBenito 493d6c
	type $1_chkpwd_t, can_read_shadow_passwords;
Chris PeBenito c9428d
	domain_type($1_chkpwd_t)
Chris PeBenito c9428d
	domain_entry_file($1_chkpwd_t,chkpwd_exec_t)
Chris PeBenito 0c73cd
	role $1_r types $1_chkpwd_t;
Chris PeBenito 0c73cd
	role $1_r types system_chkpwd_t;
Chris PeBenito c4890e
Chris PeBenito 0c73cd
	allow $1_chkpwd_t self:capability setuid;
Chris PeBenito 0c73cd
	allow $1_chkpwd_t self:process getattr;
Chris PeBenito c4890e
Chris PeBenito 139520
	files_list_etc($1_chkpwd_t)
Chris PeBenito 0c73cd
	allow $1_chkpwd_t shadow_t:file { getattr read };
Chris PeBenito 5c1621
Chris PeBenito 0c73cd
	# is_selinux_enabled
Chris PeBenito 0c73cd
	kernel_read_system_state($1_chkpwd_t)
Chris PeBenito 5c1621
Chris PeBenito 0fd9dc
	fs_dontaudit_getattr_xattr_fs($1_chkpwd_t)
Chris PeBenito 5c1621
Chris PeBenito c9428d
	domain_use_wide_inherit_fd($1_chkpwd_t)
Chris PeBenito c4890e
Chris PeBenito c9428d
	libs_use_ld_so($1_chkpwd_t)
Chris PeBenito c9428d
	libs_use_shared_libs($1_chkpwd_t)
Chris PeBenito 5c1621
Chris PeBenito 8fd367
	files_read_etc_files($1_chkpwd_t)
Chris PeBenito 0c73cd
	# for nscd
Chris PeBenito c9428d
	files_dontaudit_search_var($1_chkpwd_t)
Chris PeBenito 5c1621
Chris PeBenito c9428d
	logging_send_syslog_msg($1_chkpwd_t)
Chris PeBenito 5c1621
Chris PeBenito 0c73cd
	miscfiles_read_localization($1_chkpwd_t)
Chris PeBenito 5c1621
Chris PeBenito 5e0da6
	seutil_read_config($1_chkpwd_t)
Chris PeBenito c4890e
Chris PeBenito 0c73cd
	#can_ldap($1_chkpwd_t)
Chris PeBenito a9a20d
Chris PeBenito 0c73cd
	# Transition from the user domain to this domain.
Chris PeBenito 0fd9dc
	domain_auto_trans($1_t,chkpwd_exec_t,$1_chkpwd_t)
Chris PeBenito c4890e
Chris PeBenito 0c73cd
	allow $1_chkpwd_t $1_t:fd use;
Chris PeBenito 0c73cd
	allow $1_t $1_chkpwd_t:fd use;
Chris PeBenito 0c73cd
	allow $1_chkpwd_t $1_t:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow $1_chkpwd_t $1_t:process sigchld;
Chris PeBenito c4890e
Chris PeBenito 0c73cd
	# Write to the user domain tty.
Chris PeBenito 0c73cd
	#userdomain_use_$1_terminal($1_chkpwd_t)
Chris PeBenito 0c73cd
	#userdomain_use_$1_pty($1_chkpwd_t)
Chris PeBenito c4890e
Chris PeBenito 0c73cd
	# Inherit and use descriptors from gnome-pty-helper.
Chris PeBenito 0c73cd
	#ifdef(`gnome-pty-helper.te',`allow $1_chkpwd_t $1_gph_t:fd use;')
Chris PeBenito 5c1621
Chris PeBenito 0c73cd
	tunable_policy(`use_dns',`
Chris PeBenito dd8229
		allow $1_chkpwd_t self:udp_socket create_socket_perms;
Chris PeBenito 0fd9dc
		corenet_udp_sendrecv_all_if($1_chkpwd_t)
Chris PeBenito 0fd9dc
		corenet_raw_sendrecv_all_if($1_chkpwd_t)
Chris PeBenito 0fd9dc
		corenet_udp_sendrecv_all_nodes($1_chkpwd_t)
Chris PeBenito 0fd9dc
		corenet_raw_sendrecv_all_nodes($1_chkpwd_t)
Chris PeBenito 0fd9dc
		corenet_udp_bind_all_nodes($1_chkpwd_t)
Chris PeBenito 0fd9dc
		corenet_udp_sendrecv_dns_port($1_chkpwd_t)
Chris PeBenito c9428d
		sysnet_read_config($1_chkpwd_t)
Chris PeBenito 0c73cd
	')
Chris PeBenito 0c73cd
Chris PeBenito a7a979
	optional_policy(`kerberos.te',`
Chris PeBenito a7a979
		kerberos_use($1_chkpwd_t)
Chris PeBenito a7a979
	')
Chris PeBenito a7a979
Chris PeBenito ab940a
	optional_policy(`nis.te',`
Chris PeBenito ab940a
		nis_use_ypbind($1_chkpwd_t)
Chris PeBenito ab940a
	')
Chris PeBenito ab940a
Chris PeBenito 493d6c
	optional_policy(`nscd.te',`
Chris PeBenito 493d6c
		nscd_use_socket($1_chkpwd_t)
Chris PeBenito 493d6c
	')
Chris PeBenito 493d6c
Chris PeBenito ae9e27
	optional_policy(`selinuxutil.te',`
Chris PeBenito 5e0da6
		seutil_use_newrole_fd($1_chkpwd_t)
Chris PeBenito 0c73cd
	')
Chris PeBenito a9a20d
Chris PeBenito a7a979
')
Chris PeBenito c4890e
Chris PeBenito dd8229
########################################
Chris PeBenito 414e41
## <desc>
Chris PeBenito 414e41
##	Use the login program as an entry point program.
Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of process using the login program as entry point.
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito 199895
interface(`auth_login_entry_type',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type login_exec_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	domain_entry_file($1,login_exec_t)
Chris PeBenito 07efe9
')
Chris PeBenito 07efe9
Chris PeBenito e7fcdc
########################################
Chris PeBenito 414e41
## <desc>
Chris PeBenito 414e41
##	Execute a login_program in the target domain.
Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="target_domain">
Chris PeBenito 414e41
##	The type of the login_program process.
Chris PeBenito 414e41
## </param>
Chris PeBenito e7fcdc
#
Chris PeBenito 199895
interface(`auth_domtrans_login_program',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type login_exec_t;
Chris PeBenito 7a2f20
		class process sigchld;
Chris PeBenito 7a2f20
		class fd use;
Chris PeBenito 7a2f20
		class fifo_file rw_file_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 7a2f20
	corecmd_search_bin($1)
Chris PeBenito 7a2f20
	domain_auto_trans($1,login_exec_t,$2)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 $2:fd use;
Chris PeBenito 0c73cd
	allow $2 $1:fd use;
Chris PeBenito 0c73cd
	allow $2 $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow $2 $1:process sigchld;
Chris PeBenito e7fcdc
')
Chris PeBenito e7fcdc
Chris PeBenito dd8229
########################################
Chris PeBenito 414e41
## <desc>
Chris PeBenito 414e41
##	Run unix_chkpwd to check a password.
Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito 199895
interface(`auth_domtrans_chk_passwd',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type system_chkpwd_t, chkpwd_exec_t, shadow_t;
Chris PeBenito 7a2f20
		class process sigchld;
Chris PeBenito 7a2f20
		class udp_socket create_socket_perms;
Chris PeBenito 7a2f20
		class fd use;
Chris PeBenito 7a2f20
		class fifo_file rw_file_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 7a2f20
	corecmd_search_sbin($1)
Chris PeBenito 763c44
	domain_auto_trans($1,chkpwd_exec_t,system_chkpwd_t)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 system_chkpwd_t:fd use;
Chris PeBenito 0c73cd
	allow system_chkpwd_t $1:fd use;
Chris PeBenito 0c73cd
	allow system_chkpwd_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow system_chkpwd_t $1:process sigchld;
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 shadow_t:file { getattr read };
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	tunable_policy(`use_dns',`
Chris PeBenito dd8229
		allow $1 self:udp_socket create_socket_perms;
Chris PeBenito 0fd9dc
		corenet_udp_sendrecv_all_if($1)
Chris PeBenito 0fd9dc
		corenet_raw_sendrecv_all_if($1)
Chris PeBenito 0fd9dc
		corenet_udp_sendrecv_all_nodes($1)
Chris PeBenito 0fd9dc
		corenet_raw_sendrecv_all_nodes($1)
Chris PeBenito 0fd9dc
		corenet_udp_bind_all_nodes($1)
Chris PeBenito 0fd9dc
		corenet_udp_sendrecv_dns_port($1)
Chris PeBenito c9428d
		sysnet_read_config($1)
Chris PeBenito 0c73cd
	')
Chris PeBenito ab940a
Chris PeBenito a7a979
	optional_policy(`kerberos.te',`
Chris PeBenito a7a979
		kerberos_use($1)
Chris PeBenito a7a979
	')
Chris PeBenito a7a979
Chris PeBenito ab940a
	#can_ldap($1)
Chris PeBenito ab940a
Chris PeBenito ab940a
	optional_policy(`nis.te',`
Chris PeBenito ab940a
		nis_use_ypbind($1)
Chris PeBenito ab940a
	')
Chris PeBenito 0c73cd
')
Chris PeBenito c4890e
Chris PeBenito dd8229
########################################
Chris PeBenito 493d6c
## <summary>
Chris PeBenito 493d6c
##	Get the attributes of the shadow passwords file.
Chris PeBenito 493d6c
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito 493d6c
interface(`auth_getattr_shadow',`
Chris PeBenito 493d6c
	gen_require(`
Chris PeBenito 493d6c
		type shadow_t;
Chris PeBenito 493d6c
		class file getattr;
Chris PeBenito 493d6c
	')
Chris PeBenito 493d6c
Chris PeBenito 493d6c
	files_search_etc($1)
Chris PeBenito 493d6c
	allow $1 shadow_t:file getattr;
Chris PeBenito 493d6c
')
Chris PeBenito 493d6c
Chris PeBenito 493d6c
########################################
Chris PeBenito 493d6c
## <summary>
Chris PeBenito 493d6c
##	Do not audit attempts to get the attributes
Chris PeBenito 493d6c
##	of the shadow passwords file.
Chris PeBenito 493d6c
## </summary>
Chris PeBenito 493d6c
## <param name="domain">
Chris PeBenito 493d6c
##	Domain to not audit.
Chris PeBenito 493d6c
## </param>
Chris PeBenito 493d6c
#
Chris PeBenito 199895
interface(`auth_dontaudit_getattr_shadow',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 493d6c
		class file getattr;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 shadow_t:file getattr;
Chris PeBenito 57440f
')
Chris PeBenito 57440f
Chris PeBenito dd8229
########################################
Chris PeBenito 414e41
## <desc>
Chris PeBenito 414e41
##	Read the shadow passwords file (/etc/shadow)
Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito 199895
interface(`auth_read_shadow',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		attribute can_read_shadow_passwords;
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 7a2f20
		class file r_file_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_list_etc($1)
Chris PeBenito dd8229
	allow $1 shadow_t:file r_file_perms;
Chris PeBenito 0c73cd
	typeattribute $1 can_read_shadow_passwords;
Chris PeBenito c4890e
')
Chris PeBenito c4890e
Chris PeBenito dd8229
########################################
Chris PeBenito 414e41
## <desc>
Chris PeBenito 414e41
##	Do not audit attempts to read the shadow
Chris PeBenito 414e41
##	password file (/etc/shadow).
Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the domain to not audit.
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito 199895
interface(`auth_dontaudit_read_shadow',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 7a2f20
		class file r_file_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 shadow_t:file { getattr read };
Chris PeBenito c4890e
')
Chris PeBenito c4890e
Chris PeBenito dd8229
########################################
Chris PeBenito 414e41
## <desc>
Chris PeBenito 414e41
##	Read and write the shadow password file (/etc/shadow).
Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito 199895
interface(`auth_rw_shadow',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		attribute can_read_shadow_passwords, can_write_shadow_passwords;
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 7a2f20
		class file rw_file_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	files_list_etc($1)
Chris PeBenito 0c73cd
	allow $1 shadow_t:file rw_file_perms;
Chris PeBenito 0c73cd
	typeattribute $1 can_read_shadow_passwords, can_write_shadow_passwords;
Chris PeBenito c4890e
')
Chris PeBenito c4890e
Chris PeBenito c4890e
#######################################
Chris PeBenito c4890e
#
Chris PeBenito c9428d
# auth_manage_shadow(domain)
Chris PeBenito a1f94a
#
Chris PeBenito 199895
interface(`auth_manage_shadow',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		attribute can_read_shadow_passwords, can_write_shadow_passwords;
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 7a2f20
		class file create_file_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 shadow_t:file create_file_perms;
Chris PeBenito c9428d
	files_create_etc_config($1,shadow_t,file)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	typeattribute $1 can_read_shadow_passwords, can_write_shadow_passwords;
Chris PeBenito a1f94a
')
Chris PeBenito a1f94a
Chris PeBenito a1f94a
#######################################
Chris PeBenito a1f94a
#
Chris PeBenito c9428d
# auth_relabelto_shadow(domain)
Chris PeBenito a1f94a
#
Chris PeBenito 199895
interface(`auth_relabelto_shadow',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		attribute can_relabelto_shadow_passwords;
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 7a2f20
		class file relabelto;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_etc($1)
Chris PeBenito 0c73cd
	allow $1 shadow_t:file relabelto;
Chris PeBenito 0c73cd
	typeattribute $1 can_relabelto_shadow_passwords;
Chris PeBenito a1f94a
')
Chris PeBenito a1f94a
Chris PeBenito a1f94a
#######################################
Chris PeBenito a1f94a
#
Chris PeBenito c9428d
# auth_rw_faillog(domain)
Chris PeBenito 4bf4ed
#
Chris PeBenito 199895
interface(`auth_rw_faillog',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type faillog_t;
Chris PeBenito 7a2f20
		class file rw_file_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	logging_search_logs($1)
Chris PeBenito 7a2f20
	allow $1 faillog_t:file rw_file_perms;
Chris PeBenito 4bf4ed
')
Chris PeBenito 4bf4ed
Chris PeBenito 4bf4ed
#######################################
Chris PeBenito 4bf4ed
#
Chris PeBenito c9428d
# auth_rw_lastlog(domain)
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`auth_rw_lastlog',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type lastlog_t;
Chris PeBenito 7a2f20
		class file { getattr read write setattr };
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	logging_search_logs($1)
Chris PeBenito 0c73cd
	allow $1 lastlog_t:file { getattr read write setattr };
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito dc771f
########################################
Chris PeBenito 414e41
## <desc>
Chris PeBenito 414e41
##	Execute pam programs in the pam domain.
Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 1e5c2a
#
Chris PeBenito 199895
interface(`auth_domtrans_pam',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_t, pam_exec_t;
Chris PeBenito 7a2f20
		class process sigchld;
Chris PeBenito 7a2f20
		class fd
Chris PeBenito 7a2f20
		class fifo_file rw_file_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito dd8229
	domain_auto_trans($1,pam_exec_t,pam_t)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 pam_t:fd use;
Chris PeBenito 0c73cd
	allow pam_t $1:fd use;
Chris PeBenito 0c73cd
	allow pam_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow pam_t $1:process sigchld;
Chris PeBenito 1e5c2a
')
Chris PeBenito 1e5c2a
Chris PeBenito dc771f
########################################
Chris PeBenito 414e41
## <desc>
Chris PeBenito 414e41
##	Execute pam programs in the PAM domain.
Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="role">
Chris PeBenito 414e41
##	The role to allow the PAM domain.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="terminal">
Chris PeBenito 414e41
##	The type of the terminal allow the PAM domain to use.
Chris PeBenito 414e41
## </param>
Chris PeBenito dc771f
#
Chris PeBenito 199895
interface(`auth_run_pam',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_t;
Chris PeBenito 7a2f20
		class chr_file rw_file_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	auth_domtrans_pam($1)
Chris PeBenito 0c73cd
	role $2 types pam_t;
Chris PeBenito dd8229
	allow pam_t $3:chr_file rw_file_perms;
Chris PeBenito dc771f
')
Chris PeBenito dc771f
Chris PeBenito dd8229
########################################
Chris PeBenito 414e41
## <desc>
Chris PeBenito 414e41
##	Execute the pam program.
Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito 199895
interface(`auth_exec_pam',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_exec_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 0fd9dc
	can_exec($1,pam_exec_t)
Chris PeBenito 1e5c2a
')
Chris PeBenito 1e5c2a
Chris PeBenito 1e5c2a
#######################################
Chris PeBenito 1e5c2a
#
Chris PeBenito c9428d
# auth_read_pam_pid(domain)
Chris PeBenito dfaf6c
#
Chris PeBenito 199895
interface(`auth_read_pam_pid',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_var_run_t;
Chris PeBenito 7a2f20
		class dir r_dir_perms;
Chris PeBenito 7a2f20
		class file r_file_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito c9428d
	files_search_pids($1)
Chris PeBenito dd8229
	allow $1 pam_var_run_t:dir r_dir_perms;
Chris PeBenito dd8229
	allow $1 pam_var_run_t:file r_file_perms;
Chris PeBenito dfaf6c
')
Chris PeBenito dfaf6c
Chris PeBenito dd8229
########################################
Chris PeBenito 414e41
## <desc>
Chris PeBenito 414e41
##	Delete pam PID files.
Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito dd8229
#
Chris PeBenito 199895
interface(`auth_delete_pam_pid',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_var_run_t;
Chris PeBenito 7a2f20
		class dir { getattr search read write remove_name };
Chris PeBenito 7a2f20
		class file { getattr unlink };
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito c9428d
	files_search_pids($1)
Chris PeBenito 0c73cd
	allow $1 pam_var_run_t:dir { getattr search read write remove_name };
Chris PeBenito 0c73cd
	allow $1 pam_var_run_t:file { getattr unlink };
Chris PeBenito 3ce6cb
')
Chris PeBenito 3ce6cb
Chris PeBenito 1e5c2a
#######################################
Chris PeBenito 1e5c2a
#
Chris PeBenito c9428d
# auth_domtrans_pam_console(domain)
Chris PeBenito 1e5c2a
#
Chris PeBenito 199895
interface(`auth_domtrans_pam_console',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_console_t, pam_console_exec_t;
Chris PeBenito 7a2f20
		class process sigchld;
Chris PeBenito 7a2f20
		class fd use;
Chris PeBenito 7a2f20
		class fifo_file rw_file_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito dd8229
	domain_auto_trans($1,pam_console_exec_t,pam_console_t)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 pam_console_t:fd use;
Chris PeBenito 0c73cd
	allow pam_console_t $1:fd use;
Chris PeBenito 0c73cd
	allow pam_console_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow pam_console_t $1:process sigchld;
Chris PeBenito 1e5c2a
')
Chris PeBenito 1e5c2a
Chris PeBenito 1e5c2a
#######################################
Chris PeBenito 1e5c2a
#
Chris PeBenito c9428d
# auth_list_pam_console_data(domain)
Chris PeBenito f5c42b
#
Chris PeBenito 199895
interface(`auth_list_pam_console_data',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_var_console_t;
Chris PeBenito 7a2f20
		class dir r_dir_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito c9428d
	files_search_pids($1)
Chris PeBenito 0c73cd
	allow $1 pam_var_console_t:dir r_dir_perms;
Chris PeBenito f5c42b
')
Chris PeBenito f5c42b
Chris PeBenito f5c42b
#######################################
Chris PeBenito f5c42b
#
Chris PeBenito c9428d
# auth_read_pam_console_data(domain)
Chris PeBenito 1e5c2a
#
Chris PeBenito 199895
interface(`auth_read_pam_console_data',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_var_console_t;
Chris PeBenito 7a2f20
		class dir r_dir_perms;
Chris PeBenito 7a2f20
		class file r_file_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito c9428d
	files_search_pids($1)
Chris PeBenito 0c73cd
	allow $1 pam_var_console_t:dir r_dir_perms;
Chris PeBenito 0c73cd
	allow $1 pam_var_console_t:file r_file_perms;
Chris PeBenito 1e5c2a
')
Chris PeBenito 1e5c2a
Chris PeBenito 1e5c2a
#######################################
Chris PeBenito 1e5c2a
#
Chris PeBenito c9428d
# auth_manage_pam_console_data(domain)
Chris PeBenito 1e5c2a
#
Chris PeBenito 199895
interface(`auth_manage_pam_console_data',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type pam_var_console_t;
Chris PeBenito 7a2f20
		class dir rw_dir_perms;
Chris PeBenito 7a2f20
		class file create_file_perms;
Chris PeBenito 7a2f20
		class lnk_file create_lnk_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito c9428d
	files_search_pids($1)
Chris PeBenito dd8229
	allow $1 pam_var_console_t:dir rw_dir_perms;
Chris PeBenito 0fd9dc
	allow $1 pam_var_console_t:file create_file_perms;
Chris PeBenito dd8229
	allow $1 pam_var_console_t:lnk_file create_lnk_perms;
Chris PeBenito 1e5c2a
')
Chris PeBenito 1e5c2a
Chris PeBenito dc771f
########################################
Chris PeBenito 414e41
## <desc>
Chris PeBenito 414e41
##	Relabel all files on the filesystem, except
Chris PeBenito 414e41
##	the shadow passwords and listed exceptions.
Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the domain perfoming this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="exception_types" optional="true">
Chris PeBenito 414e41
##	The types to be excluded.  Each type or attribute
Chris PeBenito 414e41
##	must be negated by the caller.
Chris PeBenito 414e41
## </param>
Chris PeBenito efd8ed
#
Chris PeBenito efd8ed
Chris PeBenito 199895
interface(`auth_relabel_all_files_except_shadow',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	files_relabel_all_files($1,$2 -shadow_t)
Chris PeBenito efd8ed
')
Chris PeBenito efd8ed
Chris PeBenito efd8ed
########################################
Chris PeBenito 414e41
## <desc>
Chris PeBenito 414e41
##	Manage all files on the filesystem, except
Chris PeBenito 414e41
##	the shadow passwords and listed exceptions.
Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the domain perfoming this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="exception_types" optional="true">
Chris PeBenito 414e41
##	The types to be excluded.  Each type or attribute
Chris PeBenito 414e41
##	must be negated by the caller.
Chris PeBenito 414e41
## </param>
Chris PeBenito efd8ed
#
Chris PeBenito efd8ed
Chris PeBenito 199895
interface(`auth_manage_all_files_except_shadow',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type shadow_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	files_manage_all_files($1,$2 -shadow_t)
Chris PeBenito efd8ed
')
Chris PeBenito efd8ed
Chris PeBenito efd8ed
########################################
Chris PeBenito 414e41
## <desc>
Chris PeBenito 414e41
##	Execute utempter programs in the utempter domain.
Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito dc771f
#
Chris PeBenito 199895
interface(`auth_domtrans_utempter',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type utempter_t, utempter_exec_t;
Chris PeBenito 7a2f20
		class process sigchld;
Chris PeBenito 7a2f20
		class fd use;
Chris PeBenito 7a2f20
		class fifo_file rw_file_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito dd8229
	domain_auto_trans($1,utempter_exec_t,utempter_t)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 utempter_t:fd use;
Chris PeBenito 0c73cd
	allow utempter_t $1:fd use;
Chris PeBenito 0c73cd
	allow utempter_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow utempter_t $1:process sigchld;
Chris PeBenito dc771f
')
Chris PeBenito dc771f
Chris PeBenito dc771f
########################################
Chris PeBenito 414e41
## <desc>
Chris PeBenito 414e41
##	Execute utempter programs in the utempter domain.
Chris PeBenito 414e41
## </desc>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="role">
Chris PeBenito 414e41
##	The role to allow the utempter domain.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="terminal">
Chris PeBenito 414e41
##	The type of the terminal allow the utempter domain to use.
Chris PeBenito 414e41
## </param>
Chris PeBenito dc771f
#
Chris PeBenito 199895
interface(`auth_run_utempter',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type utempter_t;
Chris PeBenito 7a2f20
		class chr_file rw_file_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	auth_domtrans_utempter($1)
Chris PeBenito 0c73cd
	role $2 types utempter_t;
Chris PeBenito dd8229
	allow utempter_t $3:chr_file rw_file_perms;
Chris PeBenito dc771f
')
Chris PeBenito dc771f
Chris PeBenito b16c6b
#######################################
Chris PeBenito b16c6b
#
Chris PeBenito c9428d
# auth_read_login_records(domain)
Chris PeBenito b16c6b
#
Chris PeBenito 199895
interface(`auth_read_login_records',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type wtmp_t;
Chris PeBenito 7a2f20
		class file r_file_perms;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	logging_search_logs($1)
Chris PeBenito dd8229
	allow $1 wtmp_t:file r_file_perms;
Chris PeBenito b16c6b
')
Chris PeBenito b16c6b
Chris PeBenito b16c6b
#######################################
Chris PeBenito b16c6b
#
Chris PeBenito c9428d
# auth_dontaudit_write_login_records(domain)
Chris PeBenito b16c6b
#
Chris PeBenito 199895
interface(`auth_dontaudit_write_login_records',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type wtmp_t;
Chris PeBenito 7a2f20
		class file write;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 wtmp_t:file write;
Chris PeBenito b16c6b
')
Chris PeBenito b16c6b
Chris PeBenito b16c6b
#######################################
Chris PeBenito b16c6b
#
Chris PeBenito c9428d
# auth_rw_login_records(domain)
Chris PeBenito b16c6b
#
Chris PeBenito 199895
interface(`auth_rw_login_records',`
Chris PeBenito 0e7216
	gen_require(`
Chris PeBenito 0e7216
		type wtmp_t;
Chris PeBenito 0e7216
		class file rw_file_perms;
Chris PeBenito 0e7216
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 wtmp_t:file rw_file_perms;
Chris PeBenito c9428d
	logging_search_logs($1)
Chris PeBenito b16c6b
')
Chris PeBenito b16c6b
Chris PeBenito 96ce00
#######################################
Chris PeBenito 96ce00
#
Chris PeBenito 96ce00
# auth_manage_login_records(domain)
Chris PeBenito 96ce00
#
Chris PeBenito 96ce00
interface(`auth_manage_login_records',`
Chris PeBenito 96ce00
	gen_require(`
Chris PeBenito 96ce00
		type wtmp_t;
Chris PeBenito 96ce00
		class file create_file_perms;
Chris PeBenito 96ce00
	')
Chris PeBenito 96ce00
Chris PeBenito 96ce00
	logging_rw_log_dir($1)
Chris PeBenito 96ce00
	allow $1 wtmp_t:file create_file_perms;
Chris PeBenito 96ce00
')
Chris PeBenito 8b0bbd
Chris PeBenito 8b0bbd
########################################
Chris PeBenito 8b0bbd
## <summary>
Chris PeBenito 8b0bbd
##	Unconfined access to the authlogin module.
Chris PeBenito 8b0bbd
## </summary>
Chris PeBenito 8b0bbd
## <desc>
Chris PeBenito 8b0bbd
##	

Chris PeBenito 8b0bbd
##	Unconfined access to the authlogin module.
Chris PeBenito 8b0bbd
##	

Chris PeBenito 8b0bbd
##	

Chris PeBenito 8b0bbd
##	Currently, this only allows assertions for
Chris PeBenito 8b0bbd
##	the shadow passwords file (/etc/shadow) to
Chris PeBenito 8b0bbd
##	be passed.  No access is granted yet.
Chris PeBenito 8b0bbd
##	

Chris PeBenito 8b0bbd
## </desc>
Chris PeBenito 8b0bbd
## <param name="domain">
Chris PeBenito 8b0bbd
##	Domain allowed access.
Chris PeBenito 8b0bbd
## </param>
Chris PeBenito 8b0bbd
#
Chris PeBenito 8b0bbd
interface(`auth_unconfined',`
Chris PeBenito 8b0bbd
	gen_require(`
Chris PeBenito 8b0bbd
		attribute can_read_shadow_passwords;
Chris PeBenito 8b0bbd
		attribute can_write_shadow_passwords;
Chris PeBenito 8b0bbd
		attribute can_relabelto_shadow_passwords;
Chris PeBenito 8b0bbd
	')
Chris PeBenito 8b0bbd
Chris PeBenito 8b0bbd
	typeattribute $1 can_read_shadow_passwords;
Chris PeBenito 8b0bbd
	typeattribute $1 can_write_shadow_passwords;
Chris PeBenito 8b0bbd
	typeattribute $1 can_relabelto_shadow_passwords;
Chris PeBenito 8b0bbd
')