RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/authlogin.fc

56 lines
3.1 KiB
Plaintext
Raw Normal View History

rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/\.pwd\.lock -- gen_context(system_u:object_r:shadow_t,s0)
/etc/group\.lock -- gen_context(system_u:object_r:shadow_t,s0)
/etc/gshadow.* -- gen_context(system_u:object_r:shadow_t,s0)
/etc/passwd\.lock -- gen_context(system_u:object_r:shadow_t,s0)
/etc/shadow.* -- gen_context(system_u:object_r:shadow_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/bin/login -- gen_context(system_u:object_r:login_exec_t,s0)
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0)
/usr/bin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
/usr/bin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
/usr/bin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
/usr/bin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
/usr/bin/utempter -- gen_context(system_u:object_r:utempter_exec_t,s0)
/usr/bin/validate -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/usr/kerberos/sbin/login\.krb5 -- gen_context(system_u:object_r:login_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
authlogin: label utempter correctly on Debian When starting tmux on Debian, the following audit log appears: type=AVC msg=audit(1567781766.314:820): avc: denied { execute_no_trans } for pid=6686 comm=746D75783A20736572766572 path="/usr/lib/x86_64-linux-gnu/utempter/utempter" dev="vda1" ino=545302 scontext=sysadm_u:sysadm_r:sysadm_screen_t tcontext=system_u:object_r:lib_t tclass=file permissive=0 /usr/lib/x86_64-linux-gnu/utempter/utempter is indeed labeled as system_u:object_r:lib_t, which is wrong. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-06 16:43:23 +00:00
/usr/lib/([^/]+/)?utempter/utempter -- gen_context(system_u:object_r:utempter_exec_t,s0)
Properly label utempter helper on debian
2015-11-26 20:45:34 +00:00
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0)
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
/usr/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)
/usr/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
/usr/sbin/utempter -- gen_context(system_u:object_r:utempter_exec_t,s0)
/usr/sbin/validate -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
2017-02-04 20:19:35 +00:00
ifdef(`distro_suse', `
/usr/sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)
')
initial commit
2005-05-10 19:51:00 +00:00
trunk: 1 patch from dan.
2009-06-12 15:30:15 +00:00
/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/db/shadow.* -- gen_context(system_u:object_r:shadow_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
add patch from dan
2005-11-15 16:34:10 +00:00
/var/lib/abl(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
trunk: several fc updates from dan.
2007-12-12 15:55:21 +00:00
/var/lib/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
add patch from dan
2005-11-15 16:34:10 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/log/btmp.* -- gen_context(system_u:object_r:faillog_t,s0)
/var/log/faillog -- gen_context(system_u:object_r:faillog_t,s0)
/var/log/lastlog -- gen_context(system_u:object_r:lastlog_t,s0)
patch from dan Tue, 24 Oct 2006 11:00:28 -0400
2006-10-31 21:01:48 +00:00
/var/log/tallylog -- gen_context(system_u:object_r:faillog_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/log/wtmp.* -- gen_context(system_u:object_r:wtmp_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run/console(/.*)? gen_context(system_u:object_r:pam_var_console_t,s0)
/run/faillock(/.*)? gen_context(system_u:object_r:faillog_t,s0)
Allow Debian to generate a dynamic motd when users log in Debian's PAM configuration uses a patched pam_motd module that runs files in /etc/update-motd.d/ in order to generate a dynamic Message Of The Day (MOTD). By default, there is only one script: $ cat /etc/update-motd.d/10-uname #!/bin/sh uname -snrvm According to https://wiki.debian.org/motd, the script is executed through run-parts: if (!system("/usr/bin/env -i PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin run-parts --lsbsysinit /etc/update-motd.d > /run/motd.dynamic.new")) rename("/run/motd.dynamic.new", "/run/motd.dynamic"); This requires allowing pam_motd users to execute bin_t commands (/usr/bin/env) and shells (/bin/sh), and to manage /run/motd.dynamic* files. Allow relevant accesses for Debian-based systems. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-01 11:44:28 +00:00
/run/motd -- gen_context(system_u:object_r:pam_motd_runtime_t,s0)
/run/motd\.dynamic -- gen_context(system_u:object_r:pam_motd_runtime_t,s0)
/run/motd\.dynamic\.new -- gen_context(system_u:object_r:pam_motd_runtime_t,s0)
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run/pam_mount(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
/run/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
/run/sepermit(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
/run/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
sudo: add fcontext for /run/sudo/ts/USERNAME This lets restorecon -F set the context properly
2017-09-15 17:16:14 +00:00
/run/sudo/ts/%{USERNAME} gen_context(system_u:object_r:pam_var_run_t,s0)
authlogin: Sudo file context specification did not catch paths (squash me) Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-09-24 13:40:05 +00:00
/var/(db|adm)/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
/var/lib/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)