#DESC Pam - PAM 
# X-Debian-Packages:
#
# /sbin/pam_timestamp_check
type pam_exec_t, file_type, exec_type, sysadmfile;
type pam_t, domain, privlog, nscd_client_domain;
general_domain_access(pam_t);

type pam_var_run_t, file_type, sysadmfile;
allow pam_t pam_var_run_t:dir { search getattr read write remove_name };
allow pam_t pam_var_run_t:file { getattr read unlink };

role system_r types pam_t;
in_user_role(pam_t)
domain_auto_trans(userdomain, pam_exec_t, pam_t)

uses_shlib(pam_t)
# Read the devpts root directory.
allow pam_t devpts_t:dir r_dir_perms;

# Access terminals.
allow pam_t { ttyfile ptyfile devtty_t }:chr_file rw_file_perms;
ifdef(`gnome-pty-helper.te', `allow pam_t gphdomain:fd use;')

allow pam_t proc_t:dir search;
allow pam_t proc_t:{ lnk_file file } { getattr read };

# Read the /etc/nsswitch file
allow pam_t etc_t:file r_file_perms;

# Read /var/run.
allow pam_t { var_t var_run_t }:dir r_dir_perms;
tmp_domain(pam)

allow pam_t local_login_t:fd use;
dontaudit pam_t self:capability sys_tty_config;

allow initrc_t pam_var_run_t:dir rw_dir_perms;
allow initrc_t pam_var_run_t:file { getattr read unlink };
dontaudit pam_t initrc_var_run_t:file { read write };