## Common policy for authentication and user login. ######################################## ## ## Role access for password authentication. ## ## ## ## Role allowed access. ## ## ## ## ## Domain allowed access. ## ## # interface(`auth_role',` gen_require(` type chkpwd_t, chkpwd_exec_t, shadow_t; ') role $1 types chkpwd_t; # Transition from the user domain to this domain. domtrans_pattern($2, chkpwd_exec_t, chkpwd_t) ps_process_pattern($2, chkpwd_t) dontaudit $2 shadow_t:file read_file_perms; ') ######################################## ## ## Use PAM for authentication. ## ## ## ## Domain allowed access. ## ## # interface(`auth_use_pam',` # for SSP/ProPolice dev_read_urand($1) # for encrypted homedir dev_read_sysfs($1) auth_create_faillog_files($1) auth_domtrans_chk_passwd($1) auth_domtrans_upd_passwd($1) auth_dontaudit_read_shadow($1) auth_rw_lastlog($1) auth_rw_faillog($1) auth_rw_login_records($1) auth_setattr_faillog_files($1) auth_exec_pam($1) auth_use_nsswitch($1) logging_send_audit_msgs($1) logging_send_syslog_msg($1) optional_policy(` dbus_system_bus_client($1) optional_policy(` consolekit_dbus_chat($1) ') optional_policy(` fprintd_dbus_chat($1) ') ') optional_policy(` kerberos_manage_host_rcache($1) kerberos_read_config($1) ') optional_policy(` nis_authenticate($1) ') ') ######################################## ## ## Use the pam module systemd during authentication. ## ## ## ## Domain allowed access. ## ## # interface(`auth_use_pam_systemd',` dbus_system_bus_client($1) systemd_dbus_chat_logind($1) ') ######################################## ## ## Use the pam module motd with dynamic support during authentication. ## This module comes from Ubuntu (https://bugs.launchpad.net/ubuntu/+source/pam/+bug/399071) ## and was added to Debian (https://sources.debian.org/src/pam/1.3.1-5/debian/patches-applied/update-motd/) ## ## ## ## Domain allowed access. ## ## # interface(`auth_use_pam_motd_dynamic',` gen_require(` type pam_motd_runtime_t; ') # Allow pam_motd to run /usr/bin/env and /usr/bin/dash to generate # /run/motd.dynamic from motd.dynamic.new. corecmd_exec_bin($1) corecmd_exec_shell($1) allow $1 pam_motd_runtime_t:file manage_file_perms; files_runtime_filetrans($1, pam_motd_runtime_t, file, "motd.dynamic.new") ') ######################################## ## ## Make the specified domain used for a login program. ## ## ## ## Domain type used for a login program domain. ## ## # interface(`auth_login_pgm_domain',` gen_require(` type var_auth_t, auth_cache_t; ') domain_type($1) domain_subj_id_change_exemption($1) domain_role_change_exemption($1) domain_obj_id_change_exemption($1) role system_r types $1; # Needed for pam_selinux_permit to cleanup properly domain_read_all_domains_state($1) domain_kill_all_domains($1) # pam_keyring allow $1 self:capability ipc_lock; allow $1 self:process setkeycreate; allow $1 self:key manage_key_perms; files_list_var_lib($1) manage_files_pattern($1, var_auth_t, var_auth_t) manage_dirs_pattern($1, auth_cache_t, auth_cache_t) manage_files_pattern($1, auth_cache_t, auth_cache_t) manage_sock_files_pattern($1, auth_cache_t, auth_cache_t) files_var_filetrans($1, auth_cache_t, dir) # needed for afs - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=253321 kernel_rw_afs_state($1) # for fingerprint readers dev_rw_input_dev($1) dev_rw_generic_usb_dev($1) files_read_etc_files($1) fs_list_auto_mountpoints($1) selinux_get_fs_mount($1) selinux_validate_context($1) selinux_compute_access_vector($1) selinux_compute_create_context($1) selinux_compute_relabel_context($1) selinux_compute_user_contexts($1) mls_file_read_all_levels($1) mls_file_write_all_levels($1) mls_file_upgrade($1) mls_file_downgrade($1) mls_process_set_level($1) mls_fd_share_all_levels($1) auth_use_pam($1) init_rw_utmp($1) logging_set_loginuid($1) logging_set_tty_audit($1) seutil_read_config($1) seutil_read_default_contexts($1) userdom_search_user_runtime($1) userdom_read_user_tmpfs_files($1) tunable_policy(`allow_polyinstantiation',` files_polyinstantiate_all($1) ') optional_policy(` systemd_read_logind_state($1) systemd_write_inherited_logind_sessions_pipes($1) systemd_use_passwd_agent_fds($1) ') ') ######################################## ## ## Use the login program as an entry point program. ## ## ## ## Domain allowed access. ## ## # interface(`auth_login_entry_type',` gen_require(` type login_exec_t; ') domain_entry_file($1, login_exec_t) ') ######################################## ## ## Execute a login_program in the target domain. ## ## ## ## Domain allowed to transition. ## ## ## ## ## The type of the login_program process. ## ## # interface(`auth_domtrans_login_program',` gen_require(` type login_exec_t; ') corecmd_search_bin($1) domtrans_pattern($1, login_exec_t, $2) ') ######################################## ## ## Execute a login_program in the target domain, ## with a range transition. ## ## ## ## Domain allowed to transition. ## ## ## ## ## The type of the login_program process. ## ## ## ## ## Range of the login program. ## ## # interface(`auth_ranged_domtrans_login_program',` gen_require(` type login_exec_t; ') auth_domtrans_login_program($1, $2) ifdef(`enable_mcs',` range_transition $1 login_exec_t:process $3; ') ifdef(`enable_mls',` range_transition $1 login_exec_t:process $3; ') ') ######################################## ## ## Search authentication cache ## ## ## ## Domain allowed access. ## ## # interface(`auth_search_cache',` gen_require(` type auth_cache_t; ') allow $1 auth_cache_t:dir search_dir_perms; ') ######################################## ## ## Read authentication cache ## ## ## ## Domain allowed access. ## ## # interface(`auth_read_cache',` gen_require(` type auth_cache_t; ') read_files_pattern($1, auth_cache_t, auth_cache_t) ') ######################################## ## ## Read/Write authentication cache ## ## ## ## Domain allowed access. ## ## # interface(`auth_rw_cache',` gen_require(` type auth_cache_t; ') rw_files_pattern($1, auth_cache_t, auth_cache_t) ') ######################################## ## ## Manage authentication cache ## ## ## ## Domain allowed access. ## ## # interface(`auth_manage_cache',` gen_require(` type auth_cache_t; ') manage_dirs_pattern($1, auth_cache_t, auth_cache_t) manage_files_pattern($1, auth_cache_t, auth_cache_t) ') ####################################### ## ## Automatic transition from cache_t to cache. ## ## ## ## Domain allowed access. ## ## # interface(`auth_var_filetrans_cache',` gen_require(` type auth_cache_t; ') files_var_filetrans($1, auth_cache_t, { file dir } ) ') ######################################## ## ## Run unix_chkpwd to check a password. ## ## ## ## Domain allowed to transition. ## ## # interface(`auth_domtrans_chk_passwd',` gen_require(` type chkpwd_t, chkpwd_exec_t, shadow_t; type auth_cache_t; ') allow $1 auth_cache_t:dir search_dir_perms; corecmd_search_bin($1) domtrans_pattern($1, chkpwd_exec_t, chkpwd_t) dontaudit $1 shadow_t:file read_file_perms; dev_read_rand($1) dev_read_urand($1) auth_use_nsswitch($1) auth_rw_faillog($1) logging_send_audit_msgs($1) miscfiles_read_generic_certs($1) optional_policy(` kerberos_read_keytab($1) ') optional_policy(` pcscd_read_runtime_files($1) pcscd_stream_connect($1) ') optional_policy(` samba_stream_connect_winbind($1) ') ') ######################################## ## ## Run unix_chkpwd to check a password. ## Stripped down version to be called within boolean ## ## ## ## Domain allowed to transition. ## ## # interface(`auth_domtrans_chkpwd',` gen_require(` type chkpwd_t, chkpwd_exec_t, shadow_t; ') corecmd_search_bin($1) domtrans_pattern($1, chkpwd_exec_t, chkpwd_t) dontaudit $1 shadow_t:file { getattr read }; auth_domtrans_upd_passwd($1) ') ######################################## ## ## Execute chkpwd programs in the chkpwd domain. ## ## ## ## Domain allowed to transition. ## ## ## ## ## The role to allow the chkpwd domain. ## ## # interface(`auth_run_chk_passwd',` gen_require(` type chkpwd_t; ') auth_domtrans_chk_passwd($1) role $2 types chkpwd_t; ') ######################################## ## ## Execute a domain transition to run unix_update. ## ## ## ## Domain allowed to transition. ## ## # interface(`auth_domtrans_upd_passwd',` gen_require(` type updpwd_t, updpwd_exec_t; ') domtrans_pattern($1, updpwd_exec_t, updpwd_t) auth_dontaudit_read_shadow($1) ') ######################################## ## ## Execute updpwd programs in the updpwd domain. ## ## ## ## Domain allowed to transition. ## ## ## ## ## The role to allow the updpwd domain. ## ## # interface(`auth_run_upd_passwd',` gen_require(` type updpwd_t; ') auth_domtrans_upd_passwd($1) role $2 types updpwd_t; ') ######################################## ## ## Get the attributes of the shadow passwords file. ## ## ## ## Domain allowed access. ## ## # interface(`auth_getattr_shadow',` gen_require(` type shadow_t; ') files_search_etc($1) allow $1 shadow_t:file getattr; ') ######################################## ## ## Do not audit attempts to get the attributes ## of the shadow passwords file. ## ## ## ## Domain to not audit. ## ## # interface(`auth_dontaudit_getattr_shadow',` gen_require(` type shadow_t; ') dontaudit $1 shadow_t:file getattr; ') ######################################## ## ## Read the shadow passwords file (/etc/shadow) ## ## ## ## Domain allowed access. ## ## # # cjp: these next three interfaces are split # since typeattribute does not work in conditionals # yet, otherwise they should be one interface. # interface(`auth_read_shadow',` auth_can_read_shadow_passwords($1) auth_tunable_read_shadow($1) ') ######################################## ## ## Pass shadow assertion for reading. ## ## ##

## Pass shadow assertion for reading. ## This should only be used with ## auth_tunable_read_shadow(), and ## only exists because typeattribute ## does not work in conditionals. ##

##
## ## ## Domain allowed access. ## ## # interface(`auth_can_read_shadow_passwords',` gen_require(` attribute can_read_shadow_passwords; ') typeattribute $1 can_read_shadow_passwords; ') ######################################## ## ## Read the shadow password file. ## ## ##

## Read the shadow password file. This ## should only be used in a conditional; ## it does not pass the reading shadow ## assertion. ##

##
## ## ## Domain allowed access. ## ## # interface(`auth_tunable_read_shadow',` gen_require(` type shadow_t; ') files_list_etc($1) allow $1 shadow_t:file read_file_perms; ') ######################################## ## ## Do not audit attempts to read the shadow ## password file (/etc/shadow). ## ## ## ## Domain to not audit. ## ## # interface(`auth_dontaudit_read_shadow',` gen_require(` type shadow_t; ') dontaudit $1 shadow_t:file read_file_perms; ') ######################################## ## ## Read and write the shadow password file (/etc/shadow). ## ## ## ## Domain allowed access. ## ## # interface(`auth_rw_shadow',` gen_require(` attribute can_read_shadow_passwords, can_write_shadow_passwords; type shadow_t; ') files_list_etc($1) allow $1 shadow_t:file rw_file_perms; typeattribute $1 can_read_shadow_passwords, can_write_shadow_passwords; ') ######################################## ## ## Create, read, write, and delete the shadow ## password file. ## ## ## ## Domain allowed access. ## ## # interface(`auth_manage_shadow',` gen_require(` attribute can_read_shadow_passwords, can_write_shadow_passwords; type shadow_t; ') allow $1 shadow_t:file manage_file_perms; typeattribute $1 can_read_shadow_passwords, can_write_shadow_passwords; ') ####################################### ## ## Automatic transition from etc to shadow. ## ## ## ## Domain allowed access. ## ## # interface(`auth_etc_filetrans_shadow',` gen_require(` type shadow_t; ') files_etc_filetrans($1, shadow_t, file) ') ####################################### ## ## Relabel to the shadow ## password file type. ## ## ## ## Domain allowed access. ## ## # interface(`auth_relabelto_shadow',` gen_require(` attribute can_relabelto_shadow_passwords; type shadow_t; ') files_search_etc($1) allow $1 shadow_t:file relabelto; typeattribute $1 can_relabelto_shadow_passwords; ') ####################################### ## ## Relabel from and to the shadow ## password file type. ## ## ## ## Domain allowed access. ## ## # interface(`auth_relabel_shadow',` gen_require(` attribute can_relabelto_shadow_passwords; type shadow_t; ') files_search_etc($1) allow $1 shadow_t:file relabel_file_perms; typeattribute $1 can_relabelto_shadow_passwords; ') ####################################### ## ## Append to the login failure log. ## ## ## ## Domain allowed access. ## ## # interface(`auth_append_faillog',` gen_require(` type faillog_t; ') logging_search_logs($1) allow $1 faillog_t:file append_file_perms; ') ######################################## ## ## Create fail log lock (in /run/faillock). ## ## ## ## Domain allowed access. ## ## # interface(`auth_create_faillog_files',` gen_require(` type faillog_t; ') create_files_pattern($1, faillog_t, faillog_t) ') ######################################## ## ## Read and write the login failure log. ## ## ## ## Domain allowed access. ## ## # interface(`auth_rw_faillog',` gen_require(` type faillog_t; ') logging_search_logs($1) allow $1 faillog_t:file rw_file_perms; ') ######################################## ## ## Manage the login failure logs. ## ## ## ## Domain allowed access. ## ## # interface(`auth_manage_faillog',` gen_require(` type faillog_t; ') allow $1 faillog_t:file manage_file_perms; logging_rw_generic_log_dirs($1) ') ######################################## ## ## Setattr the login failure logs. ## ## ## ## Domain allowed access. ## ## # interface(`auth_setattr_faillog_files',` gen_require(` type faillog_t; ') setattr_files_pattern($1, faillog_t, faillog_t) ') ####################################### ## ## Read the last logins log. ## ## ## ## Domain allowed access. ## ## ## # interface(`auth_read_lastlog',` gen_require(` type lastlog_t; ') logging_search_logs($1) allow $1 lastlog_t:file read_file_perms; ') ####################################### ## ## Append only to the last logins log. ## ## ## ## Domain allowed access. ## ## # interface(`auth_append_lastlog',` gen_require(` type lastlog_t; ') logging_search_logs($1) allow $1 lastlog_t:file { append_file_perms lock }; ') ####################################### ## ## relabel the last logins log. ## ## ## ## Domain allowed access. ## ## # interface(`auth_relabel_lastlog',` gen_require(` type lastlog_t; ') logging_search_logs($1) allow $1 lastlog_t:file relabel_file_perms; ') ####################################### ## ## Read and write to the last logins log. ## ## ## ## Domain allowed access. ## ## # interface(`auth_rw_lastlog',` gen_require(` type lastlog_t; ') logging_search_logs($1) allow $1 lastlog_t:file { rw_file_perms lock setattr }; ') ######################################## ## ## Manage the last logins log. ## ## ## ## Domain allowed access. ## ## # interface(`auth_manage_lastlog',` gen_require(` type lastlog_t; ') allow $1 lastlog_t:file manage_file_perms; logging_rw_generic_log_dirs($1) ') ######################################## ## ## Execute pam programs in the pam domain. ## ## ## ## Domain allowed to transition. ## ## # interface(`auth_domtrans_pam',` gen_require(` type pam_t, pam_exec_t; ') domtrans_pattern($1, pam_exec_t, pam_t) ') ######################################## ## ## Send generic signals to pam processes. ## ## ## ## Domain allowed access. ## ## # interface(`auth_signal_pam',` gen_require(` type pam_t; ') allow $1 pam_t:process signal; ') ######################################## ## ## Execute pam programs in the PAM domain. ## ## ## ## Domain allowed to transition. ## ## ## ## ## The role to allow the PAM domain. ## ## # interface(`auth_run_pam',` gen_require(` type pam_t; ') auth_domtrans_pam($1) role $2 types pam_t; ') ######################################## ## ## Execute the pam program. ## ## ## ## Domain allowed access. ## ## # interface(`auth_exec_pam',` gen_require(` type pam_exec_t; ') can_exec($1, pam_exec_t) ') ######################################## ## ## Read var auth files. Used by various other applications ## and pam applets etc. ## ## ## ## Domain allowed access. ## ## # interface(`auth_read_var_auth',` gen_require(` type var_auth_t; ') files_search_var($1) read_files_pattern($1, var_auth_t, var_auth_t) ') ####################################### ## ## Read and write var auth files. Used by various other applications ## and pam applets etc. ## ## ## ## Domain allowed access. ## ## # interface(`auth_rw_var_auth',` gen_require(` type var_auth_t; ') files_search_var($1) rw_files_pattern($1, var_auth_t, var_auth_t) ') ######################################## ## ## Manage var auth files. Used by various other applications ## and pam applets etc. ## ## ## ## Domain allowed access. ## ## # interface(`auth_manage_var_auth',` gen_require(` type var_auth_t; ') files_search_var($1) allow $1 var_auth_t:dir manage_dir_perms; allow $1 var_auth_t:file rw_file_perms; allow $1 var_auth_t:lnk_file rw_lnk_file_perms; ') ######################################## ## ## Read PAM PID files. (Deprecated) ## ## ## ## Domain allowed access. ## ## # interface(`auth_read_pam_pid',` refpolicywarn(`$0($*) has been deprecated, please use auth_read_pam_runtime_files() instead.') auth_read_pam_runtime_files($1) ') ####################################### ## ## Do not audit attempts to read PAM PID files. (Deprecated) ## ## ## ## Domain to not audit. ## ## # interface(`auth_dontaudit_read_pam_pid',` refpolicywarn(`$0($*) has been deprecated, please use auth_dontaudit_read_pam_runtime_files() instead.') auth_dontaudit_read_pam_runtime_files($1) ') ######################################## ## ## Create specified objects in ## pid directories with the pam var ## run file type using a ## file type transition. (Deprecated) ## ## ## ## Domain allowed access. ## ## ## ## ## Class of the object being created. ## ## ## ## ## The name of the object being created. ## ## # interface(`auth_pid_filetrans_pam_var_run',` refpolicywarn(`$0($*) has been deprecated, please use auth_runtime_filetrans_pam_runtime() instead.') auth_runtime_filetrans_pam_runtime($1, $2, $3) ') ######################################## ## ## Delete pam PID files. (Deprecated) ## ## ## ## Domain allowed access. ## ## # interface(`auth_delete_pam_pid',` refpolicywarn(`$0($*) has been deprecated, please use auth_delete_pam_runtime_files() instead.') auth_delete_pam_runtime_files($1) ') ######################################## ## ## Manage pam PID files. (Deprecated) ## ## ## ## Domain allowed access. ## ## # interface(`auth_manage_pam_pid',` refpolicywarn(`$0($*) has been deprecated, please use auth_manage_pam_runtime_dirs(); auth_manage_pam_runtime_files() instead.') auth_manage_pam_runtime_dirs($1) auth_manage_pam_runtime_files($1) ') ######################################## ## ## Manage pam runtime dirs. ## ## ## ## Domain allowed access. ## ## # interface(`auth_manage_pam_runtime_dirs',` gen_require(` type pam_runtime_t; ') files_search_runtime($1) manage_dirs_pattern($1, pam_runtime_t, pam_runtime_t) ') ######################################## ## ## Create specified objects in ## pid directories with the pam runtime ## file type using a type transition. ## ## ## ## Domain allowed access. ## ## ## ## ## Class of the object being created. ## ## ## ## ## The name of the object being created. ## ## # interface(`auth_runtime_filetrans_pam_runtime',` gen_require(` type pam_runtime_t; ') files_runtime_filetrans($1, pam_runtime_t, $2, $3) ') ######################################## ## ## Read PAM runtime files. ## ## ## ## Domain allowed access. ## ## # interface(`auth_read_pam_runtime_files',` gen_require(` type pam_runtime_t; ') files_search_runtime($1) allow $1 pam_runtime_t:dir list_dir_perms; allow $1 pam_runtime_t:file read_file_perms; ') ####################################### ## ## Do not audit attempts to read PAM runtime files. ## ## ## ## Domain to not audit. ## ## # interface(`auth_dontaudit_read_pam_runtime_files',` gen_require(` type pam_runtime_t; ') dontaudit $1 pam_runtime_t:file { getattr read }; ') ######################################## ## ## Delete pam runtime files. ## ## ## ## Domain allowed access. ## ## # interface(`auth_delete_pam_runtime_files',` gen_require(` type pam_runtime_t; ') files_search_runtime($1) delete_files_pattern($1, pam_runtime_t, pam_runtime_t) ') ######################################## ## ## Create, read, write, and delete pam runtime files. ## ## ## ## Domain allowed access. ## ## # interface(`auth_manage_pam_runtime_files',` gen_require(` type pam_runtime_t; ') files_search_runtime($1) manage_files_pattern($1, pam_runtime_t, pam_runtime_t) ') ######################################## ## ## Execute pam_console with a domain transition. ## ## ## ## Domain allowed to transition. ## ## # interface(`auth_domtrans_pam_console',` gen_require(` type pam_console_t, pam_console_exec_t; ') domtrans_pattern($1, pam_console_exec_t, pam_console_t) ') ######################################## ## ## Search the contents of the ## pam_console data directory. ## ## ## ## Domain allowed access. ## ## # interface(`auth_search_pam_console_data',` gen_require(` type pam_var_console_t; ') files_search_runtime($1) allow $1 pam_var_console_t:dir search_dir_perms; ') ######################################## ## ## List the contents of the pam_console ## data directory. ## ## ## ## Domain allowed access. ## ## # interface(`auth_list_pam_console_data',` gen_require(` type pam_var_console_t; ') files_search_runtime($1) allow $1 pam_var_console_t:dir list_dir_perms; ') ######################################## ## ## Create pam var console pid directories. ## ## ## ## Domain allowed access. ## ## # interface(`auth_create_pam_console_data_dirs',` gen_require(` type pam_var_console_t; ') files_search_runtime($1) allow $1 pam_var_console_t:dir create_dir_perms; ') ######################################## ## ## Relabel pam_console data directories. ## ## ## ## Domain allowed access. ## ## # interface(`auth_relabel_pam_console_data_dirs',` gen_require(` type pam_var_console_t; ') relabel_dirs_pattern($1, pam_var_console_t, pam_var_console_t) ') ######################################## ## ## Read pam_console data files. ## ## ## ## Domain allowed access. ## ## # interface(`auth_read_pam_console_data',` gen_require(` type pam_var_console_t; ') files_search_runtime($1) allow $1 pam_var_console_t:dir list_dir_perms; allow $1 pam_var_console_t:file read_file_perms; ') ######################################## ## ## Create, read, write, and delete ## pam_console data files. ## ## ## ## Domain allowed access. ## ## # interface(`auth_manage_pam_console_data',` gen_require(` type pam_var_console_t; ') files_search_runtime($1) manage_files_pattern($1, pam_var_console_t, pam_var_console_t) manage_lnk_files_pattern($1, pam_var_console_t, pam_var_console_t) ') ####################################### ## ## Delete pam_console data. ## ## ## ## Domain allowed access. ## ## # interface(`auth_delete_pam_console_data',` gen_require(` type pam_var_console_t; ') files_search_var($1) files_search_runtime($1) delete_files_pattern($1, pam_var_console_t, pam_var_console_t) ') ######################################## ## ## Create specified objects in ## pid directories with the pam var ## console pid file type using a ## file type transition. (Deprecated) ## ## ## ## Domain allowed access. ## ## ## ## ## Class of the object being created. ## ## ## ## ## The name of the object being created. ## ## # interface(`auth_pid_filetrans_pam_var_console',` refpolicywarn(`$0($*) has been deprecated, please use auth_runtime_filetrans_pam_var_console() instead.') auth_runtime_filetrans_pam_var_console($1, $2, $3) ') ######################################## ## ## Create specified objects in generic ## runtime directories with the pam var ## console runtime file type using a ## file type transition. ## ## ## ## Domain allowed access. ## ## ## ## ## Class of the object being created. ## ## ## ## ## The name of the object being created. ## ## # interface(`auth_runtime_filetrans_pam_var_console',` gen_require(` type pam_var_console_t; ') files_runtime_filetrans($1, pam_var_console_t, $2, $3) ') ######################################## ## ## Execute utempter programs in the utempter domain. ## ## ## ## Domain allowed to transition. ## ## # interface(`auth_domtrans_utempter',` gen_require(` type utempter_t, utempter_exec_t; ') domtrans_pattern($1, utempter_exec_t, utempter_t) ') ######################################## ## ## Execute utempter programs in the utempter domain. ## ## ## ## Domain allowed to transition. ## ## ## ## ## The role to allow the utempter domain. ## ## # interface(`auth_run_utempter',` gen_require(` type utempter_t; ') auth_domtrans_utempter($1) role $2 types utempter_t; ') ####################################### ## ## Do not audit attempts to execute utempter executable. ## ## ## ## Domain to not audit. ## ## # interface(`auth_dontaudit_exec_utempter',` gen_require(` type utempter_exec_t; ') dontaudit $1 utempter_exec_t:file { execute execute_no_trans }; ') ######################################## ## ## Set the attributes of login record files. ## ## ## ## Domain allowed access. ## ## # interface(`auth_setattr_login_records',` gen_require(` type wtmp_t; ') allow $1 wtmp_t:file setattr; logging_search_logs($1) ') ######################################## ## ## Read login records files (/var/log/wtmp). ## ## ## ## Domain allowed access. ## ## ## # interface(`auth_read_login_records',` gen_require(` type wtmp_t; ') logging_search_logs($1) allow $1 wtmp_t:file read_file_perms; ') ######################################## ## ## Do not audit attempts to read login records ## files (/var/log/wtmp). ## ## ## ## Domain to not audit. ## ## ## # interface(`auth_dontaudit_read_login_records',` gen_require(` type wtmp_t; ') dontaudit $1 wtmp_t:file read_file_perms; ') ######################################## ## ## Do not audit attempts to write to ## login records files. ## ## ## ## Domain to not audit. ## ## # interface(`auth_dontaudit_write_login_records',` gen_require(` type wtmp_t; ') dontaudit $1 wtmp_t:file write; ') ####################################### ## ## Append to login records (wtmp). ## ## ## ## Domain allowed access. ## ## # interface(`auth_append_login_records',` gen_require(` type wtmp_t; ') allow $1 wtmp_t:file append_file_perms; logging_search_logs($1) ') ####################################### ## ## Write to login records (wtmp). ## ## ## ## Domain allowed access. ## ## # interface(`auth_write_login_records',` gen_require(` type wtmp_t; ') allow $1 wtmp_t:file { write_file_perms lock }; ') ######################################## ## ## Read and write login records. ## ## ## ## Domain allowed access. ## ## # interface(`auth_rw_login_records',` gen_require(` type wtmp_t; ') allow $1 wtmp_t:file rw_file_perms; logging_search_logs($1) ') ######################################## ## ## Create a login records in the log directory ## using a type transition. ## ## ## ## Domain allowed access. ## ## # interface(`auth_log_filetrans_login_records',` gen_require(` type wtmp_t; ') logging_log_filetrans($1, wtmp_t, file) ') ######################################## ## ## Create, read, write, and delete login ## records files. ## ## ## ## Domain allowed access. ## ## # interface(`auth_manage_login_records',` gen_require(` type wtmp_t; ') logging_rw_generic_log_dirs($1) allow $1 wtmp_t:file manage_file_perms; ') ######################################## ## ## Relabel login record files. ## ## ## ## Domain allowed access. ## ## # interface(`auth_relabel_login_records',` gen_require(` type wtmp_t; ') allow $1 wtmp_t:file relabel_file_perms; ') ######################################## ## ## Use nsswitch to look up user, password, group, or ## host information. ## ## ##

## Allow the specified domain to look up user, password, ## group, or host information using the name service. ## The most common use of this interface is for services ## that do host name resolution (usually DNS resolution). ##

##
## ## ## Domain allowed access. ## ## ## # interface(`auth_use_nsswitch',` gen_require(` attribute nsswitch_domain; ') typeattribute $1 nsswitch_domain; ') ######################################## ## ## Unconfined access to the authlogin module. ## ## ##

## Unconfined access to the authlogin module. ##

##

## Currently, this only allows assertions for ## the shadow passwords file (/etc/shadow) to ## be passed. No access is granted yet. ##

##
## ## ## Domain allowed access. ## ## # interface(`auth_unconfined',` gen_require(` attribute can_read_shadow_passwords; attribute can_write_shadow_passwords; attribute can_relabelto_shadow_passwords; ') typeattribute $1 can_read_shadow_passwords; typeattribute $1 can_write_shadow_passwords; typeattribute $1 can_relabelto_shadow_passwords; ')