Merge pull request SELinuxProject#626 from dsugar100/main

Allow local login to read /run/motd
aosedge · Aug 2, 2023 · 97e35d8 · 97e35d8
2 parents 90d3f5c + a120ea8
commit 97e35d8
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 0 deletions.
diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
@@ -118,6 +118,25 @@ interface(`auth_use_pam_motd_dynamic',`
 	files_runtime_filetrans($1, pam_motd_runtime_t, file, "motd.dynamic.new")
 ')
 
+########################################
+## <summary>
+##	Read the pam module motd with dynamic support during authentication.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`auth_read_pam_motd_dynamic',`
+	gen_require(`
+		type pam_motd_runtime_t;
+	')
+
+	files_search_runtime($1)
+	allow $1 pam_motd_runtime_t:file read_file_perms;
+')
+
 ########################################
 ## <summary>
 ##	Make the specified domain used for a login program.

diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
@@ -128,6 +128,7 @@ auth_manage_pam_runtime_dirs(local_login_t)
 auth_manage_pam_runtime_files(local_login_t)
 auth_manage_pam_console_data(local_login_t)
 auth_domtrans_pam_console(local_login_t)
+auth_read_pam_motd_dynamic(local_login_t)
 
 init_dontaudit_use_fds(local_login_t)