Chris PeBenito e181fe
Chris PeBenito a52492
policy_module(authlogin,1.2.1)
Chris PeBenito 960373
Chris PeBenito 3ba13b
########################################
Chris PeBenito 3ba13b
#
Chris PeBenito 3ba13b
# Declarations
Chris PeBenito 3ba13b
#
Chris PeBenito 7bba9d
Chris PeBenito 7bba9d
attribute can_read_shadow_passwords;
Chris PeBenito 7bba9d
attribute can_write_shadow_passwords;
Chris PeBenito 7bba9d
attribute can_relabelto_shadow_passwords;
Chris PeBenito 7bba9d
Chris PeBenito 3ba13b
type chkpwd_exec_t;
Chris PeBenito 8fd367
files_type(chkpwd_exec_t)
Chris PeBenito 3ba13b
Chris PeBenito 3ba13b
type faillog_t;
Chris PeBenito c9428d
logging_log_file(faillog_t)
Chris PeBenito 3ba13b
Chris PeBenito b4cd15
type lastlog_t;
Chris PeBenito c9428d
logging_log_file(lastlog_t)
Chris PeBenito b4cd15
Chris PeBenito 77f6e2
# real declaration moved to mls until
Chris PeBenito 77f6e2
# range_transition works in loadable modules
Chris PeBenito 77f6e2
gen_require(`
Chris PeBenito 77f6e2
	type login_exec_t;
Chris PeBenito 77f6e2
')
Chris PeBenito 8fd367
files_type(login_exec_t)
Chris PeBenito 3ba13b
Chris PeBenito f0574f
type pam_console_t;
Chris PeBenito 07d6e3
type pam_console_exec_t;
Chris PeBenito c9428d
init_system_domain(pam_console_t,pam_console_exec_t)
Chris PeBenito 75a10b
role system_r types pam_console_t;
Chris PeBenito 75a10b
Chris PeBenito 493d6c
type pam_t;
Chris PeBenito c9428d
domain_type(pam_t)
Chris PeBenito 3ce6cb
role system_r types pam_t;
Chris PeBenito 3ba13b
Chris PeBenito 07d6e3
type pam_exec_t;
Chris PeBenito c9428d
domain_entry_file(pam_t,pam_exec_t)
Chris PeBenito 07d6e3
Chris PeBenito 3ba13b
type pam_tmp_t;
Chris PeBenito c9428d
files_tmp_file(pam_tmp_t)
Chris PeBenito 3ba13b
Chris PeBenito 493d6c
type pam_var_console_t;
Chris PeBenito 8fd367
files_type(pam_var_console_t)
Chris PeBenito 3ba13b
Chris PeBenito 3ba13b
type pam_var_run_t;
Chris PeBenito c9428d
files_pid_file(pam_var_run_t)
Chris PeBenito 3ba13b
Chris PeBenito 3ba13b
type shadow_t;
Chris PeBenito 6f11d6
files_security_file(shadow_t)
Chris PeBenito 3ba13b
neverallow ~can_read_shadow_passwords shadow_t:file read;
Chris PeBenito a1f94a
neverallow ~can_write_shadow_passwords shadow_t:file { create write };
Chris PeBenito a1f94a
neverallow ~can_relabelto_shadow_passwords shadow_t:file relabelto;
Chris PeBenito 3ba13b
Chris PeBenito 8ba1bd
authlogin_common_auth_domain_template(system)
Chris PeBenito 5c1621
role system_r types system_chkpwd_t;
Chris PeBenito 5c1621
Chris PeBenito 493d6c
type utempter_t;
Chris PeBenito c9428d
domain_type(utempter_t)
Chris PeBenito 3ba13b
Chris PeBenito 3ba13b
type utempter_exec_t;
Chris PeBenito c9428d
domain_entry_file(utempter_t,utempter_exec_t)
Chris PeBenito 3ba13b
Chris PeBenito 7b062e
#
Chris PeBenito 7b062e
# var_auth_t is the type of /var/lib/auth, usually
Chris PeBenito 7b062e
# used for auth data in pam_able
Chris PeBenito 7b062e
#
Chris PeBenito 7b062e
type var_auth_t;
Chris PeBenito 7b062e
files_type(var_auth_t)
Chris PeBenito 7b062e
Chris PeBenito b4cd15
type wtmp_t;
Chris PeBenito c9428d
logging_log_file(wtmp_t)
Chris PeBenito 3ba13b
Chris PeBenito 3ba13b
########################################
Chris PeBenito 3ba13b
#
Chris PeBenito 3ce6cb
# PAM local policy
Chris PeBenito 3ba13b
#
Chris PeBenito 3ce6cb
Chris PeBenito 9d3bdc
allow pam_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
Chris PeBenito 3ce6cb
dontaudit pam_t self:capability sys_tty_config;
Chris PeBenito 3ce6cb
Chris PeBenito 3ce6cb
allow pam_t self:fd use;
Chris PeBenito dd8229
allow pam_t self:fifo_file rw_file_perms;
Chris PeBenito dd8229
allow pam_t self:unix_dgram_socket create_socket_perms; 
Chris PeBenito dd8229
allow pam_t self:unix_stream_socket rw_stream_socket_perms;
Chris PeBenito 3ce6cb
allow pam_t self:unix_dgram_socket sendto;
Chris PeBenito 3ce6cb
allow pam_t self:unix_stream_socket connectto;
Chris PeBenito dd8229
allow pam_t self:shm create_shm_perms;
Chris PeBenito dd8229
allow pam_t self:sem create_sem_perms;
Chris PeBenito dd8229
allow pam_t self:msgq create_msgq_perms;
Chris PeBenito 3ce6cb
allow pam_t self:msg { send receive };
Chris PeBenito 3ce6cb
Chris PeBenito 3ce6cb
allow pam_t pam_var_run_t:dir { search getattr read write remove_name };
Chris PeBenito 3ce6cb
allow pam_t pam_var_run_t:file { getattr read unlink };
Chris PeBenito 3ce6cb
Chris PeBenito dd8229
allow pam_t pam_tmp_t:dir create_dir_perms;
Chris PeBenito dd8229
allow pam_t pam_tmp_t:file create_file_perms;
Chris PeBenito 9d5949
files_filetrans_tmp(pam_t, pam_tmp_t, { file dir })
Chris PeBenito 3ce6cb
Chris PeBenito 3ce6cb
kernel_read_system_state(pam_t)
Chris PeBenito 3ce6cb
Chris PeBenito ab940a
fs_search_auto_mountpoints(pam_t)
Chris PeBenito ab940a
Chris PeBenito 0fd9dc
term_use_all_user_ttys(pam_t)
Chris PeBenito 0fd9dc
term_use_all_user_ptys(pam_t)
Chris PeBenito 3ce6cb
Chris PeBenito 68228b
init_dontaudit_rw_utmp(pam_t)
Chris PeBenito 3ce6cb
Chris PeBenito 8fd367
files_read_etc_files(pam_t)
Chris PeBenito c9428d
files_list_pids(pam_t)
Chris PeBenito 3ce6cb
Chris PeBenito c9428d
libs_use_ld_so(pam_t)
Chris PeBenito c9428d
libs_use_shared_libs(pam_t)
Chris PeBenito 3ce6cb
Chris PeBenito c9428d
logging_send_syslog_msg(pam_t)
Chris PeBenito 3ce6cb
Chris PeBenito c9428d
userdom_use_unpriv_users_fd(pam_t)
Chris PeBenito dc771f
Chris PeBenito 132880
optional_policy(`locallogin',`
Chris PeBenito c9428d
	locallogin_use_fd(pam_t)
Chris PeBenito 3ce6cb
')
Chris PeBenito 3ce6cb
Chris PeBenito 132880
optional_policy(`nis',`
Chris PeBenito ab940a
	nis_use_ypbind(pam_t)
Chris PeBenito 3ce6cb
')
Chris PeBenito 3ce6cb
Chris PeBenito 132880
optional_policy(`nscd',`
Chris PeBenito 493d6c
	nscd_use_socket(pam_t)
Chris PeBenito 493d6c
')
Chris PeBenito 493d6c
Chris PeBenito 3ce6cb
########################################
Chris PeBenito 3ce6cb
#
Chris PeBenito 75a10b
# PAM console local policy
Chris PeBenito 75a10b
#
Chris PeBenito 75a10b
Chris PeBenito 75a10b
allow pam_console_t self:capability { chown fowner fsetid };
Chris PeBenito 75a10b
dontaudit pam_console_t self:capability sys_tty_config;
Chris PeBenito 75a10b
Chris PeBenito 75a10b
allow pam_console_t self:process { sigchld sigkill sigstop signull signal };
Chris PeBenito 75a10b
Chris PeBenito 75a10b
# for /var/run/console.lock checking
Chris PeBenito dd8229
allow pam_console_t pam_var_console_t:dir r_dir_perms;;
Chris PeBenito dd8229
allow pam_console_t pam_var_console_t:file r_file_perms;
Chris PeBenito 77f6e2
dontaudit pam_console_t pam_var_console_t:file write;
Chris PeBenito 77f6e2
allow pam_console_t pam_var_console_t:lnk_file { getattr read };
Chris PeBenito 75a10b
Chris PeBenito 445522
kernel_read_kernel_sysctls(pam_console_t)
Chris PeBenito 0fd9dc
kernel_use_fd(pam_console_t)
Chris PeBenito 0907bd
# Read /proc/meminfo
Chris PeBenito 0907bd
kernel_read_system_state(pam_console_t)
Chris PeBenito 75a10b
Chris PeBenito d35c62
dev_read_sysfs(pam_console_t)
Chris PeBenito 207c47
dev_getattr_apm_bios_dev(pam_console_t)
Chris PeBenito 207c47
dev_setattr_apm_bios_dev(pam_console_t)
Chris PeBenito 207c47
dev_getattr_framebuffer_dev(pam_console_t)
Chris PeBenito 207c47
dev_setattr_framebuffer_dev(pam_console_t)
Chris PeBenito 207c47
dev_getattr_misc_dev(pam_console_t)
Chris PeBenito 207c47
dev_setattr_misc_dev(pam_console_t)
Chris PeBenito 207c47
dev_getattr_mouse_dev(pam_console_t)
Chris PeBenito 207c47
dev_setattr_mouse_dev(pam_console_t)
Chris PeBenito 207c47
dev_getattr_power_mgmt_dev(pam_console_t)
Chris PeBenito 207c47
dev_setattr_power_mgmt_dev(pam_console_t)
Chris PeBenito 207c47
dev_getattr_scanner_dev(pam_console_t)
Chris PeBenito 207c47
dev_setattr_scanner_dev(pam_console_t)
Chris PeBenito 207c47
dev_getattr_sound_dev(pam_console_t)
Chris PeBenito 207c47
dev_setattr_sound_dev(pam_console_t)
Chris PeBenito 7a2f20
dev_getattr_video_dev(pam_console_t)
Chris PeBenito 7a2f20
dev_setattr_video_dev(pam_console_t)
Chris PeBenito cf6a7d
dev_getattr_xserver_misc_dev(pam_console_t)
Chris PeBenito cf6a7d
dev_setattr_xserver_misc_dev(pam_console_t)
Chris PeBenito d35c62
Chris PeBenito ab940a
fs_search_auto_mountpoints(pam_console_t)
Chris PeBenito ab940a
Chris PeBenito 0fd9dc
storage_getattr_fixed_disk(pam_console_t)
Chris PeBenito 0fd9dc
storage_setattr_fixed_disk(pam_console_t)
Chris PeBenito 0fd9dc
storage_getattr_removable_device(pam_console_t)
Chris PeBenito 5a45e7
storage_setattr_removable_device(pam_console_t)
Chris PeBenito 7a2f20
storage_getattr_scsi_generic(pam_console_t)
Chris PeBenito 7a2f20
storage_setattr_scsi_generic(pam_console_t)
Chris PeBenito 75a10b
Chris PeBenito 0fd9dc
term_use_console(pam_console_t)
Chris PeBenito 0907bd
term_setattr_console(pam_console_t)
Chris PeBenito 0fd9dc
term_getattr_unallocated_ttys(pam_console_t)
Chris PeBenito 0fd9dc
term_setattr_unallocated_ttys(pam_console_t)
Chris PeBenito 75a10b
Chris PeBenito 77f6e2
auth_use_nsswitch(pam_console_t)
Chris PeBenito 77f6e2
Chris PeBenito c9428d
domain_use_wide_inherit_fd(pam_console_t)
Chris PeBenito 75a10b
Chris PeBenito 8fd367
files_read_etc_files(pam_console_t)
Chris PeBenito c9428d
files_search_pids(pam_console_t)
Chris PeBenito c9428d
files_list_mnt(pam_console_t)
Chris PeBenito 689f6d
# read /etc/mtab
Chris PeBenito 689f6d
files_read_etc_runtime_files(pam_console_t)
Chris PeBenito 75a10b
Chris PeBenito d35c62
init_use_fd(pam_console_t)
Chris PeBenito d35c62
init_use_script_pty(pam_console_t)
Chris PeBenito d35c62
Chris PeBenito c9428d
libs_use_ld_so(pam_console_t)
Chris PeBenito c9428d
libs_use_shared_libs(pam_console_t)
Chris PeBenito 75a10b
Chris PeBenito c9428d
logging_send_syslog_msg(pam_console_t)
Chris PeBenito 75a10b
Chris PeBenito f0574f
mls_file_read_up(pam_console_t)
Chris PeBenito bf080a
mls_file_write_down(pam_console_t)
Chris PeBenito f0574f
Chris PeBenito 5e0da6
seutil_read_file_contexts(pam_console_t)
Chris PeBenito 75a10b
Chris PeBenito c9428d
userdom_dontaudit_use_unpriv_user_fd(pam_console_t)
Chris PeBenito dc771f
Chris PeBenito e5f806
# cjp: with the old daemon_(base_)domain being broken up into
Chris PeBenito e5f806
# a daemon and system interface, this probably is not needed:
Chris PeBenito 763c44
ifdef(`direct_sysadm_daemon', `
Chris PeBenito c9428d
	userdom_dontaudit_use_sysadm_terms(pam_console_t)
Chris PeBenito 75a10b
')
Chris PeBenito 75a10b
Chris PeBenito 254bbc
ifdef(`targeted_policy', `
Chris PeBenito 0fd9dc
	term_dontaudit_use_unallocated_tty(pam_console_t)
Chris PeBenito 31908b
	term_dontaudit_use_generic_pty(pam_console_t)
Chris PeBenito 9e04f5
	files_dontaudit_read_root_files(pam_console_t)
Chris PeBenito 75a10b
')
Chris PeBenito 75a10b
Chris PeBenito 132880
optional_policy(`gpm',`
Chris PeBenito f862c3
	gpm_getattr_gpmctl(pam_console_t)
Chris PeBenito f862c3
	gpm_setattr_gpmctl(pam_console_t)
Chris PeBenito f862c3
')
Chris PeBenito f862c3
Chris PeBenito 132880
optional_policy(`hotplug',`
Chris PeBenito c9428d
	hotplug_use_fd(pam_console_t)
Chris PeBenito c9428d
	hotplug_dontaudit_search_config(pam_console_t)
Chris PeBenito 1e5c2a
')
Chris PeBenito 1e5c2a
Chris PeBenito 132880
optional_policy(`nscd',`
Chris PeBenito 493d6c
	nscd_use_socket(pam_console_t)
Chris PeBenito 493d6c
')
Chris PeBenito 493d6c
Chris PeBenito 132880
optional_policy(`selinuxutil',`
Chris PeBenito 8fd367
	seutil_sigchld_newrole(pam_console_t)
Chris PeBenito 75a10b
')
Chris PeBenito 75a10b
Chris PeBenito 132880
optional_policy(`udev',`
Chris PeBenito c9428d
	udev_read_db(pam_console_t)
Chris PeBenito 75a10b
')
Chris PeBenito 75a10b
Chris PeBenito 75a10b
ifdef(`TODO',`
Chris PeBenito 75a10b
ifdef(`xdm.te', `
Chris PeBenito 0c73cd
	allow pam_console_t xdm_var_run_t:file { getattr read };
Chris PeBenito 75a10b
')
Chris PeBenito 75a10b
') dnl endif TODO
Chris PeBenito 75a10b
Chris PeBenito 75a10b
########################################
Chris PeBenito 75a10b
#
Chris PeBenito f66a1a
# System check password local policy
Chris PeBenito f66a1a
#
Chris PeBenito f66a1a
Chris PeBenito 725926
allow system_chkpwd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
Chris PeBenito f66a1a
Chris PeBenito 5c1621
allow system_chkpwd_t shadow_t:file { getattr read };
Chris PeBenito 5c1621
Chris PeBenito 725926
corecmd_search_sbin(system_chkpwd_t)
Chris PeBenito 725926
Chris PeBenito 51f5c6
domain_dontaudit_use_wide_inherit_fd(system_chkpwd_t)
Chris PeBenito 51f5c6
Chris PeBenito 8ba1bd
term_dontaudit_use_unallocated_tty(system_chkpwd_t)
Chris PeBenito 8ba1bd
term_dontaudit_use_generic_pty(system_chkpwd_t)
Chris PeBenito ebdc3b
Chris PeBenito 98a8ea
userdom_dontaudit_use_unpriv_user_tty(system_chkpwd_t)
Chris PeBenito 5c1621
Chris PeBenito f66a1a
########################################
Chris PeBenito f66a1a
#
Chris PeBenito 3ce6cb
# Utempter local policy
Chris PeBenito 3ce6cb
#
Chris PeBenito 3ce6cb
Chris PeBenito 3ce6cb
allow utempter_t self:capability setgid;
Chris PeBenito 0fd9dc
allow utempter_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito 3ce6cb
Chris PeBenito dd8229
allow utempter_t wtmp_t:file rw_file_perms;
Chris PeBenito 3ce6cb
Chris PeBenito 77f6e2
dev_read_urand(utempter_t)
Chris PeBenito 77f6e2
Chris PeBenito 0fd9dc
term_getattr_all_user_ttys(utempter_t)
Chris PeBenito 0fd9dc
term_getattr_all_user_ptys(utempter_t)
Chris PeBenito 0fd9dc
term_dontaudit_use_all_user_ttys(utempter_t)
Chris PeBenito 0fd9dc
term_dontaudit_use_all_user_ptys(utempter_t)
Chris PeBenito 0fd9dc
term_dontaudit_use_ptmx(utempter_t)
Chris PeBenito 3ce6cb
Chris PeBenito 68228b
init_rw_utmp(utempter_t)
Chris PeBenito 3ce6cb
Chris PeBenito 8fd367
files_read_etc_files(utempter_t)
Chris PeBenito 3ce6cb
Chris PeBenito c9428d
domain_use_wide_inherit_fd(utempter_t)
Chris PeBenito 3ce6cb
Chris PeBenito c9428d
libs_use_ld_so(utempter_t)
Chris PeBenito c9428d
libs_use_shared_libs(utempter_t)
Chris PeBenito 3ce6cb
Chris PeBenito c9428d
logging_search_logs(utempter_t)
Chris PeBenito 3ce6cb
Chris PeBenito 3ce6cb
# Allow utemper to write to /tmp/.xses-*
Chris PeBenito ab940a
userdom_write_unpriv_user_tmp(utempter_t)
Chris PeBenito 3ce6cb
Chris PeBenito 132880
optional_policy(`nscd',`
Chris PeBenito 493d6c
	nscd_use_socket(utempter_t)
Chris PeBenito 493d6c
')
Chris PeBenito 493d6c
Chris PeBenito 605ba2
ifdef(`TODO',`
Chris PeBenito 132880
optional_policy(`xdm',`
Chris PeBenito 605ba2
	can_pipe_xdm(utempter_t)
Chris PeBenito 605ba2
')
Chris PeBenito 3ce6cb
')