selinux-refpolicy/strict/domains/program/login.te

#DESC Login - Local/remote login utilities
#
# Authors:  Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser  
# Macroised by Russell Coker <russell@coker.com.au>
# X-Debian-Packages: login
#

#################################
# 
# Rules for the local_login_t domain
# and the remote_login_t domain.
#

# $1 is the name of the domain (local or remote)
define(`login_domain', `
type $1_login_t, domain, privuser, privrole, privlog, auth_chkpwd, privowner, privfd, nscd_client_domain, mlsfilewrite, mlsprocsetsl, mlsfileupgrade, mlsfiledowngrade;
role system_r types $1_login_t;

dontaudit $1_login_t shadow_t:file { getattr read };

general_domain_access($1_login_t);

# Read system information files in /proc.
r_dir_file($1_login_t, proc_t)

base_file_read_access($1_login_t)

# Read directories and files with the readable_t type.
# This type is a general type for "world"-readable files.
allow $1_login_t readable_t:dir r_dir_perms;
allow $1_login_t readable_t:notdevfile_class_set r_file_perms;

# Read /var, /var/spool
allow $1_login_t { var_t var_spool_t }:dir search;

# for when /var/mail is a sym-link
allow $1_login_t var_t:lnk_file read;

# Read /etc.
r_dir_file($1_login_t, etc_t)
allow $1_login_t etc_runtime_t:{ file lnk_file } r_file_perms;

read_locale($1_login_t)

# for SSP/ProPolice
allow $1_login_t urandom_device_t:chr_file { getattr read };

# Read executable types.
allow $1_login_t exec_type:{ file lnk_file } r_file_perms;

# Read /dev directories and any symbolic links.
allow $1_login_t device_t:dir r_dir_perms;
allow $1_login_t device_t:lnk_file r_file_perms;

uses_shlib($1_login_t);

tmp_domain($1_login)

ifdef(`pam.te', `
can_exec($1_login_t, pam_exec_t)
')

ifdef(`pamconsole.te', `
rw_dir_create_file($1_login_t, pam_var_console_t)
')

# Use capabilities
allow $1_login_t self:capability { dac_override chown fowner fsetid kill setgid setuid net_bind_service sys_nice sys_resource sys_tty_config };
allow $1_login_t self:process setrlimit;
dontaudit $1_login_t sysfs_t:dir search;

# Set exec context.
can_setexec($1_login_t)

allow $1_login_t autofs_t:dir { search read getattr };
allow $1_login_t mnt_t:dir r_dir_perms;

if (use_nfs_home_dirs) {
r_dir_file($1_login_t, nfs_t)
}

if (use_samba_home_dirs) {
r_dir_file($1_login_t, cifs_t)
}

# Login can polyinstantiate
polyinstantiater($1_login_t)

# FIXME: what is this for?
ifdef(`xdm.te', `
allow xdm_t $1_login_t:process signull;
')

ifdef(`crack.te', `
allow $1_login_t crack_db_t:file r_file_perms;
')

# Permit login to search the user home directories.
allow $1_login_t home_root_t:dir search;
allow $1_login_t home_dir_type:dir search;

# Write to /var/run/utmp.
allow $1_login_t var_run_t:dir search;
allow $1_login_t initrc_var_run_t:file rw_file_perms;

# Write to /var/log/wtmp.
allow $1_login_t var_log_t:dir search;
allow $1_login_t wtmp_t:file rw_file_perms;

# Write to /var/log/lastlog.
allow $1_login_t lastlog_t:file rw_file_perms;

# Write to /var/log/btmp
allow $1_login_t faillog_t:file { lock append read write };

# Search for mail spool file.
allow $1_login_t mail_spool_t:dir r_dir_perms;
allow $1_login_t mail_spool_t:file getattr;
allow $1_login_t mail_spool_t:lnk_file read;

# Get security policy decisions.
can_getsecurity($1_login_t)

# allow read access to default_contexts in /etc/security
allow $1_login_t default_context_t:file r_file_perms;
allow $1_login_t default_context_t:dir search;
r_dir_file($1_login_t, selinux_config_t)

allow $1_login_t mouse_device_t:chr_file { getattr setattr };

ifdef(`targeted_policy',`
unconfined_domain($1_login_t)
domain_auto_trans($1_login_t, shell_exec_t, unconfined_t)
')

')dnl end login_domain macro
#################################
#
# Rules for the local_login_t domain.
#
# local_login_t is the domain of a login process 
# spawned by getty.
#
# remote_login_t is the domain of a login process 
# spawned by rlogind.
#
# login_exec_t is the type of the login program
#
type login_exec_t, file_type, sysadmfile, exec_type;

login_domain(local)

# But also permit other user domains to be entered by login.
login_spawn_domain(local_login, userdomain)

# Do not audit denied attempts to access devices.
dontaudit local_login_t fixed_disk_device_t:blk_file { getattr setattr };
dontaudit local_login_t removable_device_t:blk_file { getattr setattr };
dontaudit local_login_t device_t:{ chr_file blk_file lnk_file } { getattr setattr };
dontaudit local_login_t misc_device_t:{ chr_file blk_file } { getattr setattr };
dontaudit local_login_t framebuf_device_t:chr_file { getattr setattr read };
dontaudit local_login_t apm_bios_t:chr_file { getattr setattr };
dontaudit local_login_t v4l_device_t:chr_file { getattr setattr read };
dontaudit local_login_t removable_device_t:chr_file { getattr setattr };
dontaudit local_login_t scanner_device_t:chr_file { getattr setattr };

# Do not audit denied attempts to access /mnt.
dontaudit local_login_t mnt_t:dir r_dir_perms;


# Create lock file.
lock_domain(local_login)

# Read and write ttys.
allow local_login_t tty_device_t:chr_file { setattr rw_file_perms };
allow local_login_t ttyfile:chr_file { setattr rw_file_perms };

# Relabel ttys.
allow local_login_t tty_device_t:chr_file { getattr relabelfrom relabelto };
allow local_login_t ttyfile:chr_file { getattr relabelfrom relabelto };

ifdef(`gpm.te',
`allow local_login_t gpmctl_t:sock_file { getattr setattr };')

# Allow setting of attributes on sound devices.
allow local_login_t sound_device_t:chr_file { getattr setattr };

# Allow setting of attributes on power management devices.
allow local_login_t power_device_t:chr_file { getattr setattr };
dontaudit local_login_t init_t:fd use;

#################################
#
# Rules for the remote_login_t domain.
#

login_domain(remote)

# Only permit unprivileged user domains to be entered via rlogin,
# since very weak authentication is used.
login_spawn_domain(remote_login, unpriv_userdomain)

allow remote_login_t devpts_t:dir search;
allow remote_login_t userpty_type:chr_file { setattr write };

# Use the pty created by rlogind.
ifdef(`rlogind.te', `
allow remote_login_t rlogind_devpts_t:chr_file { setattr rw_file_perms };

# Relabel ptys created by rlogind.
allow remote_login_t rlogind_devpts_t:chr_file { relabelfrom relabelto };
')

# Use the pty created by telnetd.
ifdef(`telnetd.te', `
allow remote_login_t telnetd_devpts_t:chr_file { setattr rw_file_perms };

# Relabel ptys created by telnetd.
allow remote_login_t telnetd_devpts_t:chr_file { relabelfrom relabelto };
')

allow remote_login_t ptyfile:chr_file { getattr relabelfrom relabelto ioctl };
allow remote_login_t fs_t:filesystem { getattr };

# Allow remote login to resolve host names (passed in via the -h switch)
can_resolve(remote_login_t)