#DESC Pam - PAM 

# X-Debian-Packages:

#

# /sbin/pam_timestamp_check

type pam_exec_t, file_type, exec_type, sysadmfile;

type pam_t, domain, privlog, nscd_client_domain;

general_domain_access(pam_t);

type pam_var_run_t, file_type, sysadmfile;

allow pam_t pam_var_run_t:dir { search getattr read write remove_name };

allow pam_t pam_var_run_t:file { getattr read unlink };

role system_r types pam_t;

in_user_role(pam_t)

domain_auto_trans(userdomain, pam_exec_t, pam_t)

uses_shlib(pam_t)

# Read the devpts root directory.

allow pam_t devpts_t:dir r_dir_perms;

# Access terminals.

allow pam_t { ttyfile ptyfile devtty_t }:chr_file rw_file_perms;

ifdef(`gnome-pty-helper.te', `allow pam_t gphdomain:fd use;')

allow pam_t proc_t:dir search;

allow pam_t proc_t:{ lnk_file file } { getattr read };

# Read the /etc/nsswitch file

allow pam_t etc_t:file r_file_perms;

# Read /var/run.

allow pam_t { var_t var_run_t }:dir r_dir_perms;

tmp_domain(pam)

allow pam_t local_login_t:fd use;

dontaudit pam_t self:capability sys_tty_config;

allow initrc_t pam_var_run_t:dir rw_dir_perms;

allow initrc_t pam_var_run_t:file { getattr read unlink };

dontaudit pam_t initrc_var_run_t:file rw_file_perms;

# Supress xdm denial

ifdef(`xdm.te', `

dontaudit pam_t xdm_t:fd use;

') dnl ifdef