#DESC Pamconsole - PAM console

# X-Debian-Packages:

#

# pam_console_apply

daemon_base_domain(pam_console, `, nscd_client_domain, mlsfileread')

type pam_var_console_t, file_type, sysadmfile;

allow pam_console_t etc_t:file { getattr read ioctl };

allow pam_console_t self:unix_stream_socket create_stream_socket_perms;

# Read /etc/mtab

allow pam_console_t etc_runtime_t:file { read getattr };

# Read /proc/meminfo

allow pam_console_t proc_t:file { read getattr };

allow pam_console_t self:capability { chown fowner fsetid };

# Allow access to /dev/console through the fd:

allow pam_console_t console_device_t:chr_file { read write setattr };

allow pam_console_t { kernel_t init_t }:fd use;

# for /var/run/console.lock checking

allow pam_console_t { var_t var_run_t }:dir search;

r_dir_file(pam_console_t, pam_var_console_t)

# Allow to set attributes on /dev entries

allow pam_console_t device_t:dir { getattr read };

allow pam_console_t device_t:lnk_file { getattr read };

# mouse_device_t is for joy sticks

allow pam_console_t { xserver_misc_device_t framebuf_device_t v4l_device_t apm_bios_t sound_device_t misc_device_t tty_device_t scanner_device_t mouse_device_t power_device_t removable_device_t scsi_generic_device_t }:chr_file { getattr setattr };

allow pam_console_t { removable_device_t fixed_disk_device_t }:blk_file { getattr setattr };

allow pam_console_t mnt_t:dir r_dir_perms;

ifdef(`gpm.te', `

allow pam_console_t gpmctl_t:sock_file { getattr setattr };

')

ifdef(`hotplug.te', `

dontaudit pam_console_t hotplug_etc_t:dir search;

allow pam_console_t hotplug_t:fd use;

')

ifdef(`xdm.te', `

allow pam_console_t xdm_var_run_t:file { getattr read };

')

allow initrc_t pam_var_console_t:dir rw_dir_perms;

allow initrc_t pam_var_console_t:file unlink;

allow pam_console_t file_context_t:file { getattr read };