https://martin-ueding.de/posts/pam-mount-selinux/

lightdm-utab.te

module lightdm-utab 1.0;

require {
	type unlabeled_t;
	type mount_var_run_t;
        type home_root_t;
	type xdm_t;
	class file { append create getattr read write open };
	class dir { create write setattr };
}

#============= xdm_t ==============
allow xdm_t home_root_t:dir { create setattr };
allow xdm_t home_root_t:file { create write };

allow xdm_t mount_var_run_t:file { read getattr open };

allow xdm_t unlabeled_t:dir write;
allow xdm_t unlabeled_t:file { read append getattr write };

make-pam-plots.sh

#!/bin/bash
# Copyright © 2016 Martin Ueding <[email protected]>

set -e
set -u
set -x

for program in dot neato
do
    for version in '' 2
    do
        for suffix in svg pdf
        do
            python3 pam_tree$version.py /etc/pam.d/* | $program -T $suffix -o pam$version-friese-$program.$suffix
            python3 pam_tree$version.py ~/welsh/pam.d/* | $program -T $suffix -o pam$version-welsh-$program.$suffix
            python3 pam_tree$version.py ~/Downloads/arch_pam.d/etc/pam.d/* | $program -T $suffix -o pam$version-arch-$program.$suffix
        done
    done
done

pam_tree.py

#!/usr/bin/python3
# -*- coding: utf-8 -*-

# Copyright © 2016 Martin Ueding <[email protected]>
# Licensed under The MIT License

import argparse
import os.path


def main():
    options = _parse_args()

    includes = {}

    files = options.input
    for file_ in files:
        basename = os.path.basename(file_)
        includes[basename] = []
        with open(file_) as f:
            for line in f:
                words = line.split()
                if len(words) >= 3 and words[1] in ['include', 'substack']:
                    includes[basename].append(words[2])

                if len(words) == 2 and words[0] == '@include':
                    includes[basename].append(words[1])

    print('digraph {')
    print('rankdir=LR')

    for file_, include in includes.items():
        for inc in set(include):
            print('"{}" -> "{}"'.format(inc, file_))
    print('}')


def _parse_args():
    '''
    Parses the command line arguments.

    :return: Namespace with arguments.
    :rtype: Namespace
    '''
    parser = argparse.ArgumentParser(description='')
    parser.add_argument('input', nargs='+')
    options = parser.parse_args()

    return options


if __name__ == '__main__':
    main()

pam_tree2.py

#!/usr/bin/python3
# -*- coding: utf-8 -*-

# Copyright © 2016 Martin Ueding <[email protected]>
# Licensed under The MIT License

import argparse
import os.path


def main():
    options = _parse_args()

    includes = {}
    loads = {}

    files = options.input
    for file_ in files:
        basename = os.path.basename(file_)
        includes[basename] = []
        loads[basename] = []
        with open(file_) as f:
            for line in f:
                words = line.split()
                if len(words) >= 3 and words[1] in ['include', 'substack']:
                    includes[basename].append(words[2])

                if len(words) >= 3 and words[1] in ['required', 'optional']:
                    loads[basename].append(words[2])

                if len(words) == 2 and words[0] == '@include':
                    includes[basename].append(words[1])

    print('digraph {')
    print('''rankdir=LR   
          overlap = false
          splines = true''')

    for file_, include in includes.items():
        for inc in set(include):
            print('"{}" -> "{}"'.format(inc, file_))

    print('{ rank=same')
    print('"pam_mount.so" [color=red]')
    for file_, load in loads.items():
        for l in set(load):
            print('"{}" [shape=box]'.format(l))
    print('}')

    for file_, load in loads.items():
        for l in set(load):
            print('"{}" -> "{}"'.format(l, file_))
    print('}')


def _parse_args():
    '''
    Parses the command line arguments.

    :return: Namespace with arguments.
    :rtype: Namespace
    '''
    parser = argparse.ArgumentParser(description='')
    parser.add_argument('input', nargs='+')
    options = parser.parse_args()

    return options


if __name__ == '__main__':
    main()