From mboxrd@z Thu Jan  1 00:00:00 1970
From: guido@trentalancia.com (Guido Trentalancia)
Date: Wed, 16 Feb 2011 07:27:51 +0100
Subject: [refpolicy] [PATCH 23/34]: patch to add needed permissions to the
 authlogin module
Message-ID: <1297837671.3205.88.camel@tesla.lan>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

This patch adds some needed permissions to the chkpwd_t domain
in policy/modules/system/authlogin.te.

--- refpolicy-git-15022011/policy/modules/system/authlogin.te	2011-01-08 19:07:21.347757938 +0100
+++ refpolicy-git-15022011-new-modified/policy/modules/system/authlogin.te	2011-02-15 22:30:53.148753919 +0100
@@ -83,11 +83,13 @@ logging_log_file(wtmp_t)
 
 allow chkpwd_t self:capability { dac_override setuid };
 dontaudit chkpwd_t self:capability sys_tty_config;
-allow chkpwd_t self:process getattr;
+allow chkpwd_t self:process { getattr signal };
 
 allow chkpwd_t shadow_t:file read_file_perms;
 files_list_etc(chkpwd_t)
 
+kernel_read_crypto_sysctls(chkpwd_t)
+
 # is_selinux_enabled
 kernel_read_system_state(chkpwd_t)