#DESC Login - Local/remote login utilities # # Authors: Stephen Smalley and Timothy Fraser # Macroised by Russell Coker # X-Debian-Packages: login # ################################# # # Rules for the local_login_t domain # and the remote_login_t domain. # # $1 is the name of the domain (local or remote) define(`login_domain', ` type $1_login_t, domain, privuser, privrole, privlog, auth_chkpwd, privowner, privfd, nscd_client_domain, mlsfilewrite, mlsprocsetsl, mlsfileupgrade, mlsfiledowngrade; role system_r types $1_login_t; dontaudit $1_login_t shadow_t:file { getattr read }; general_domain_access($1_login_t); # Read system information files in /proc. r_dir_file($1_login_t, proc_t) base_file_read_access($1_login_t) # Read directories and files with the readable_t type. # This type is a general type for "world"-readable files. allow $1_login_t readable_t:dir r_dir_perms; allow $1_login_t readable_t:notdevfile_class_set r_file_perms; # Read /var, /var/spool allow $1_login_t { var_t var_spool_t }:dir search; # for when /var/mail is a sym-link allow $1_login_t var_t:lnk_file read; # Read /etc. r_dir_file($1_login_t, etc_t) allow $1_login_t etc_runtime_t:{ file lnk_file } r_file_perms; read_locale($1_login_t) # for SSP/ProPolice allow $1_login_t urandom_device_t:chr_file { getattr read }; # Read executable types. allow $1_login_t exec_type:{ file lnk_file } r_file_perms; # Read /dev directories and any symbolic links. allow $1_login_t device_t:dir r_dir_perms; allow $1_login_t device_t:lnk_file r_file_perms; uses_shlib($1_login_t); tmp_domain($1_login) ifdef(`pam.te', ` can_exec($1_login_t, pam_exec_t) ') ifdef(`pamconsole.te', ` rw_dir_create_file($1_login_t, pam_var_console_t) domain_auto_trans($1_login_t, pam_console_exec_t, pam_console_t) ') ifdef(`alsa.te', ` domain_auto_trans($1_login_t, alsa_exec_t, alsa_t) ') # Use capabilities allow $1_login_t self:capability { dac_override chown fowner fsetid kill setgid setuid net_bind_service sys_nice sys_resource sys_tty_config }; allow $1_login_t self:process setrlimit; dontaudit $1_login_t sysfs_t:dir search; # Set exec context. can_setexec($1_login_t) allow $1_login_t autofs_t:dir { search read getattr }; allow $1_login_t mnt_t:dir r_dir_perms; if (use_nfs_home_dirs) { r_dir_file($1_login_t, nfs_t) } if (use_samba_home_dirs) { r_dir_file($1_login_t, cifs_t) } # Login can polyinstantiate polyinstantiater($1_login_t) # FIXME: what is this for? ifdef(`xdm.te', ` allow xdm_t $1_login_t:process signull; ') ifdef(`crack.te', ` allow $1_login_t crack_db_t:file r_file_perms; ') # Permit login to search the user home directories. allow $1_login_t home_root_t:dir search; allow $1_login_t home_dir_type:dir search; # Write to /var/run/utmp. allow $1_login_t var_run_t:dir search; allow $1_login_t initrc_var_run_t:file rw_file_perms; # Write to /var/log/wtmp. allow $1_login_t var_log_t:dir search; allow $1_login_t wtmp_t:file rw_file_perms; # Write to /var/log/lastlog. allow $1_login_t lastlog_t:file rw_file_perms; # Write to /var/log/btmp allow $1_login_t faillog_t:file { lock append read write }; # Search for mail spool file. allow $1_login_t mail_spool_t:dir r_dir_perms; allow $1_login_t mail_spool_t:file getattr; allow $1_login_t mail_spool_t:lnk_file read; # Get security policy decisions. can_getsecurity($1_login_t) # allow read access to default_contexts in /etc/security allow $1_login_t default_context_t:file r_file_perms; allow $1_login_t default_context_t:dir search; r_dir_file($1_login_t, selinux_config_t) allow $1_login_t mouse_device_t:chr_file { getattr setattr }; ifdef(`targeted_policy',` unconfined_domain($1_login_t) domain_auto_trans($1_login_t, shell_exec_t, unconfined_t) ') ')dnl end login_domain macro ################################# # # Rules for the local_login_t domain. # # local_login_t is the domain of a login process # spawned by getty. # # remote_login_t is the domain of a login process # spawned by rlogind. # # login_exec_t is the type of the login program # type login_exec_t, file_type, sysadmfile, exec_type; login_domain(local) # But also permit other user domains to be entered by login. login_spawn_domain(local_login, userdomain) # Do not audit denied attempts to access devices. dontaudit local_login_t fixed_disk_device_t:blk_file { getattr setattr }; dontaudit local_login_t removable_device_t:blk_file { getattr setattr }; dontaudit local_login_t device_t:{ chr_file blk_file lnk_file } { getattr setattr }; dontaudit local_login_t misc_device_t:{ chr_file blk_file } { getattr setattr }; dontaudit local_login_t framebuf_device_t:chr_file { getattr setattr read }; dontaudit local_login_t apm_bios_t:chr_file { getattr setattr }; dontaudit local_login_t v4l_device_t:chr_file { getattr setattr read }; dontaudit local_login_t removable_device_t:chr_file { getattr setattr }; dontaudit local_login_t scanner_device_t:chr_file { getattr setattr }; # Do not audit denied attempts to access /mnt. dontaudit local_login_t mnt_t:dir r_dir_perms; # Create lock file. lock_domain(local_login) # Read and write ttys. allow local_login_t tty_device_t:chr_file { setattr rw_file_perms }; allow local_login_t ttyfile:chr_file { setattr rw_file_perms }; # Relabel ttys. allow local_login_t tty_device_t:chr_file { getattr relabelfrom relabelto }; allow local_login_t ttyfile:chr_file { getattr relabelfrom relabelto }; ifdef(`gpm.te', `allow local_login_t gpmctl_t:sock_file { getattr setattr };') # Allow setting of attributes on sound devices. allow local_login_t sound_device_t:chr_file { getattr setattr }; # Allow setting of attributes on power management devices. allow local_login_t power_device_t:chr_file { getattr setattr }; dontaudit local_login_t init_t:fd use; ################################# # # Rules for the remote_login_t domain. # login_domain(remote) # Only permit unprivileged user domains to be entered via rlogin, # since very weak authentication is used. login_spawn_domain(remote_login, unpriv_userdomain) allow remote_login_t userpty_type:chr_file { setattr write }; # Use the pty created by rlogind. ifdef(`rlogind.te', ` can_access_pty(remote_login_t, rlogind) # Relabel ptys created by rlogind. allow remote_login_t rlogind_devpts_t:chr_file { setattr relabelfrom relabelto }; ') # Use the pty created by telnetd. ifdef(`telnetd.te', ` can_access_pty(remote_login_t, telnetd) # Relabel ptys created by telnetd. allow remote_login_t telnetd_devpts_t:chr_file { setattr relabelfrom relabelto }; ') allow remote_login_t ptyfile:chr_file { getattr relabelfrom relabelto ioctl }; allow remote_login_t fs_t:filesystem { getattr }; # Allow remote login to resolve host names (passed in via the -h switch) can_resolve(remote_login_t) ifdef(`use_mcs', ` ifdef(`getty.te', ` range_transition getty_t login_exec_t s0 - s0:c0.c255; ') ')