114 lines
4.3 KiB
Plaintext
114 lines
4.3 KiB
Plaintext
|
#DESC Mailman - GNU Mailman mailing list manager
|
||
|
|
#
|
||
|
|
# Author: Russell Coker <russell@coker.com.au>
|
||
|
|
# X-Debian-Packages: mailman
|
||
|
|
|
||
|
|
type mailman_data_t, file_type, sysadmfile;
|
||
|
|
type mailman_archive_t, file_type, sysadmfile;
|
||
|
|
|
||
|
|
type mailman_log_t, file_type, sysadmfile, logfile;
|
||
|
|
type mailman_lock_t, file_type, sysadmfile, lockfile;
|
||
|
|
|
||
|
|
define(`mailman_domain', `
|
||
|
|
type mailman_$1_t, domain, privlog $2;
|
||
|
|
type mailman_$1_exec_t, file_type, sysadmfile, exec_type;
|
||
|
|
role system_r types mailman_$1_t;
|
||
|
|
file_type_auto_trans(mailman_$1_t, var_log_t, mailman_log_t, file)
|
||
|
|
allow mailman_$1_t mailman_log_t:dir rw_dir_perms;
|
||
|
|
create_dir_file(mailman_$1_t, mailman_data_t)
|
||
|
|
uses_shlib(mailman_$1_t)
|
||
|
|
can_exec_any(mailman_$1_t)
|
||
|
|
read_sysctl(mailman_$1_t)
|
||
|
|
allow mailman_$1_t proc_t:dir search;
|
||
|
|
allow mailman_$1_t proc_t:file { read getattr };
|
||
|
|
allow mailman_$1_t var_lib_t:dir r_dir_perms;
|
||
|
|
allow mailman_$1_t var_lib_t:lnk_file read;
|
||
|
|
allow mailman_$1_t device_t:dir search;
|
||
|
|
allow mailman_$1_t etc_runtime_t:file { read getattr };
|
||
|
|
read_locale(mailman_$1_t)
|
||
|
|
file_type_auto_trans(mailman_$1_t, var_lock_t, mailman_lock_t, file)
|
||
|
|
allow mailman_$1_t mailman_lock_t:dir rw_dir_perms;
|
||
|
|
allow mailman_$1_t fs_t:filesystem getattr;
|
||
|
|
can_network(mailman_$1_t)
|
||
|
|
allow mailman_$1_t smtp_port_t:tcp_socket name_connect;
|
||
|
|
can_ypbind(mailman_$1_t)
|
||
|
|
allow mailman_$1_t self:{ unix_stream_socket unix_dgram_socket } create_socket_perms;
|
||
|
|
allow mailman_$1_t var_t:dir r_dir_perms;
|
||
|
|
tmp_domain(mailman_$1)
|
||
|
|
')
|
||
|
|
|
||
|
|
mailman_domain(queue, `, auth_chkpwd, nscd_client_domain')
|
||
|
|
can_tcp_connect(mailman_queue_t, mail_server_domain)
|
||
|
|
|
||
|
|
can_exec(mailman_queue_t, su_exec_t)
|
||
|
|
allow mailman_queue_t self:capability { setgid setuid };
|
||
|
|
allow mailman_queue_t self:fifo_file rw_file_perms;
|
||
|
|
dontaudit mailman_queue_t var_run_t:dir search;
|
||
|
|
allow mailman_queue_t proc_t:lnk_file { getattr read };
|
||
|
|
|
||
|
|
# for su
|
||
|
|
dontaudit mailman_queue_t selinux_config_t:dir search;
|
||
|
|
allow mailman_queue_t self:dir search;
|
||
|
|
allow mailman_queue_t self:file { getattr read };
|
||
|
|
allow mailman_queue_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
allow mailman_queue_t self:lnk_file { getattr read };
|
||
|
|
|
||
|
|
# some of the following could probably be changed to dontaudit, someone who
|
||
|
|
# knows mailman well should test this out and send the changes
|
||
|
|
allow mailman_queue_t sysadm_home_dir_t:dir { getattr search };
|
||
|
|
|
||
|
|
mailman_domain(mail)
|
||
|
|
dontaudit mailman_mail_t mta_delivery_agent:tcp_socket { read write };
|
||
|
|
allow mailman_mail_t mta_delivery_agent:fd use;
|
||
|
|
ifdef(`qmail.te', `
|
||
|
|
allow mailman_mail_t qmail_spool_t:file { read ioctl getattr };
|
||
|
|
# do we really need this?
|
||
|
|
allow mailman_mail_t qmail_lspawn_t:fifo_file write;
|
||
|
|
')
|
||
|
|
|
||
|
|
create_dir_file(mailman_queue_t, mailman_archive_t)
|
||
|
|
|
||
|
|
ifdef(`apache.te', `
|
||
|
|
mailman_domain(cgi)
|
||
|
|
can_tcp_connect(mailman_cgi_t, mail_server_domain)
|
||
|
|
|
||
|
|
domain_auto_trans({ httpd_t httpd_suexec_t }, mailman_cgi_exec_t, mailman_cgi_t)
|
||
|
|
# should have separate types for public and private archives
|
||
|
|
r_dir_file(httpd_t, mailman_archive_t)
|
||
|
|
create_dir_file(mailman_cgi_t, mailman_archive_t)
|
||
|
|
allow httpd_t mailman_data_t:dir { getattr search };
|
||
|
|
|
||
|
|
dontaudit mailman_cgi_t httpd_log_t:file append;
|
||
|
|
allow httpd_t mailman_cgi_t:process signal;
|
||
|
|
allow mailman_cgi_t httpd_t:process sigchld;
|
||
|
|
allow mailman_cgi_t httpd_t:fd use;
|
||
|
|
allow mailman_cgi_t httpd_t:fifo_file { getattr read write ioctl };
|
||
|
|
allow mailman_cgi_t httpd_sys_script_t:dir search;
|
||
|
|
allow mailman_cgi_t devtty_t:chr_file { read write };
|
||
|
|
allow mailman_cgi_t self:process { fork sigchld };
|
||
|
|
allow mailman_cgi_t var_spool_t:dir search;
|
||
|
|
')
|
||
|
|
|
||
|
|
allow mta_delivery_agent mailman_data_t:dir search;
|
||
|
|
allow mta_delivery_agent mailman_data_t:lnk_file read;
|
||
|
|
allow initrc_t mailman_data_t:lnk_file read;
|
||
|
|
allow initrc_t mailman_data_t:dir r_dir_perms;
|
||
|
|
domain_auto_trans({ mta_delivery_agent initrc_t }, mailman_mail_exec_t, mailman_mail_t)
|
||
|
|
ifdef(`direct_sysadm_daemon', `
|
||
|
|
domain_auto_trans(sysadm_t, mailman_mail_exec_t, mailman_mail_t)
|
||
|
|
')
|
||
|
|
allow mailman_mail_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
|
||
|
|
system_crond_entry(mailman_queue_exec_t, mailman_queue_t)
|
||
|
|
allow mailman_queue_t devtty_t:chr_file { read write };
|
||
|
|
allow mailman_queue_t self:process { fork signal sigchld };
|
||
|
|
allow mailman_queue_t self:netlink_route_socket r_netlink_socket_perms;
|
||
|
|
|
||
|
|
# so MTA can access /var/lib/mailman/mail/wrapper
|
||
|
|
allow mta_delivery_agent var_lib_t:dir search;
|
||
|
|
|
||
|
|
# Handle mailman log files
|
||
|
|
rw_dir_create_file(logrotate_t, mailman_log_t)
|
||
|
|
allow logrotate_t mailman_data_t:dir search;
|
||
|
|
can_exec(logrotate_t, mailman_mail_exec_t)
|