add ptchown policy from dan.

3 files changed, 52 insertions, 0 deletions

diff --git a/policy/modules/apps/ptchown.fc b/policy/modules/apps/ptchown.fc
new file mode 100644
index 00000000..9fc398e8
--- /dev/null
+++ b/policy/modules/apps/ptchown.fc
@@ -0,0 +1 @@
+/usr/libexec/pt_chown	--	gen_context(system_u:object_r:ptchown_exec_t,s0)
diff --git a/policy/modules/apps/ptchown.if b/policy/modules/apps/ptchown.if
new file mode 100644
index 00000000..cc8a359c
--- /dev/null
+++ b/policy/modules/apps/ptchown.if
@@ -0,0 +1,20 @@
+## <summary>helper function for grantpt(3), changes ownship and permissions of pseudotty</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to run ptchown.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`ptchown_domtrans',`
+	gen_require(`
+		type ptchown_t, ptchown_exec_t;
+	')
+
+	domtrans_pattern($1, ptchown_exec_t, ptchown_t)
+')
+
diff --git a/policy/modules/apps/ptchown.te b/policy/modules/apps/ptchown.te
new file mode 100644
index 00000000..6db843e9
--- /dev/null
+++ b/policy/modules/apps/ptchown.te
@@ -0,0 +1,31 @@
+
+policy_module(ptchown, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type ptchown_t;
+type ptchown_exec_t;
+application_domain(ptchown_t, ptchown_exec_t)
+role system_r types ptchown_t;
+
+########################################
+#
+# ptchown local policy
+#
+
+allow ptchown_t self:capability { chown fowner fsetid setuid };
+allow ptchown_t self:process { getcap setcap };
+
+files_read_etc_files(ptchown_t)
+
+fs_rw_anon_inodefs_files(ptchown_t)
+
+term_setattr_generic_ptys(ptchown_t)
+term_setattr_all_user_ptys(ptchown_t)
+term_use_generic_ptys(ptchown_t)
+term_use_ptmx(ptchown_t)
+
+miscfiles_read_localization(ptchown_t)