Your IP : 216.73.216.179
abi <abi/5.0>,
include <tunables/global>
profile who @{coreutil_dirs}who {
include <abstractions/base>
# who can theoretically take an arbitrary file argument but there seems to be
# no common reason why one would want to pass a file not listed in the below
# abstraction, or their rotated equivalents
include <abstractions/wutmp>
# rotated logs
/var/log/wtmp.@{d} r,
/var/log/btmp.@{d} r,
# Despite listing information about consoles, <abstractions/consoles> does not
# seem to be needed:
# - Current logged-in users and their terminals is grabbed from files listed
# in <abstractions/wutmp>
# - Any additional information about the terminals is obtained via a
# combination of dirfd=openat(AT_FDCWD, "/dev", O_RDONLY|O_PATH|O_DIRECTORY)
# and newfstatat(dirfd, terminal_name, out_ptr)
# - O_PATH fds bypass mediation so /dev/ r, is not needed for the first step
# - fstatat does not require permissions on the file itself, as stated in its
# man page
# Overall result: the above calls are not mediated by LSMs
@{coreutil_dirs}who mr,
# who sends the "exists" signal via kill(pid, 0)
capability kill,
# Deny the writes allowed by abstractions/wutmp
audit deny /var/** w,
audit deny @{run}/utmp w,
include if exists <local/who>
}