selinux-policy/policy/modules/services/dovecot.te


policy_module(dovecot, 1.12.0)

########################################
#
# Declarations
#
type dovecot_t;
type dovecot_exec_t;
init_daemon_domain(dovecot_t, dovecot_exec_t)

type dovecot_auth_t;
type dovecot_auth_exec_t;
domain_type(dovecot_auth_t)
domain_entry_file(dovecot_auth_t, dovecot_auth_exec_t)
role system_r types dovecot_auth_t;

type dovecot_auth_tmp_t;
files_tmp_file(dovecot_auth_tmp_t)

type dovecot_cert_t;
files_type(dovecot_cert_t)

type dovecot_deliver_t;
type dovecot_deliver_exec_t;
domain_type(dovecot_deliver_t)
domain_entry_file(dovecot_deliver_t, dovecot_deliver_exec_t)
role system_r types dovecot_deliver_t;

type dovecot_etc_t;
files_config_file(dovecot_etc_t)

type dovecot_initrc_exec_t;
init_script_file(dovecot_initrc_exec_t)

type dovecot_passwd_t;
files_type(dovecot_passwd_t)

type dovecot_spool_t;
files_type(dovecot_spool_t)

type dovecot_tmp_t;
files_tmp_file(dovecot_tmp_t)

# /var/lib/dovecot holds SSL parameters file
type dovecot_var_lib_t;
files_type(dovecot_var_lib_t)

type dovecot_var_log_t;
logging_log_file(dovecot_var_log_t)

type dovecot_var_run_t;
files_pid_file(dovecot_var_run_t)

########################################
#
# dovecot local policy
#

allow dovecot_t self:capability { dac_override dac_read_search chown kill net_bind_service setgid setuid sys_chroot };
dontaudit dovecot_t self:capability sys_tty_config;
allow dovecot_t self:process { setrlimit signal_perms getcap setcap };
allow dovecot_t self:fifo_file rw_fifo_file_perms;
allow dovecot_t self:tcp_socket create_stream_socket_perms;
allow dovecot_t self:unix_dgram_socket create_socket_perms;
allow dovecot_t self:unix_stream_socket { create_stream_socket_perms connectto };

domtrans_pattern(dovecot_t, dovecot_auth_exec_t, dovecot_auth_t)

allow dovecot_t dovecot_auth_t:process signal;

allow dovecot_t dovecot_cert_t:dir list_dir_perms;
read_files_pattern(dovecot_t, dovecot_cert_t, dovecot_cert_t)
read_lnk_files_pattern(dovecot_t, dovecot_cert_t, dovecot_cert_t)

allow dovecot_t dovecot_etc_t:file read_file_perms;
files_search_etc(dovecot_t)

can_exec(dovecot_t, dovecot_exec_t)

manage_dirs_pattern(dovecot_t, dovecot_tmp_t, dovecot_tmp_t)
manage_files_pattern(dovecot_t, dovecot_tmp_t, dovecot_tmp_t)
files_tmp_filetrans(dovecot_t, dovecot_tmp_t, { file dir })

# Allow dovecot to create and read SSL parameters file
manage_files_pattern(dovecot_t, dovecot_var_lib_t, dovecot_var_lib_t)
files_search_var_lib(dovecot_t)
files_read_var_symlinks(dovecot_t)

manage_dirs_pattern(dovecot_t, dovecot_var_log_t, dovecot_var_log_t)
manage_files_pattern(dovecot_t, dovecot_var_log_t, dovecot_var_log_t)
logging_log_filetrans(dovecot_t, dovecot_var_log_t, { file dir })

manage_dirs_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t)
manage_files_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t)
manage_lnk_files_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t)

manage_files_pattern(dovecot_t, dovecot_var_run_t, dovecot_var_run_t)
manage_lnk_files_pattern(dovecot_t, dovecot_var_run_t, dovecot_var_run_t)
manage_sock_files_pattern(dovecot_t, dovecot_var_run_t, dovecot_var_run_t)
files_pid_filetrans(dovecot_t, dovecot_var_run_t, file)

kernel_read_kernel_sysctls(dovecot_t)
kernel_read_system_state(dovecot_t)

corenet_all_recvfrom_unlabeled(dovecot_t)
corenet_all_recvfrom_netlabel(dovecot_t)
corenet_tcp_sendrecv_generic_if(dovecot_t)
corenet_tcp_sendrecv_generic_node(dovecot_t)
corenet_tcp_sendrecv_all_ports(dovecot_t)
corenet_tcp_bind_generic_node(dovecot_t)
corenet_tcp_bind_mail_port(dovecot_t)
corenet_tcp_bind_pop_port(dovecot_t)
corenet_tcp_connect_all_ports(dovecot_t)
corenet_tcp_connect_postgresql_port(dovecot_t)
corenet_sendrecv_pop_server_packets(dovecot_t)
corenet_sendrecv_all_client_packets(dovecot_t)

dev_read_sysfs(dovecot_t)
dev_read_urand(dovecot_t)

fs_getattr_all_fs(dovecot_t)
fs_getattr_all_dirs(dovecot_t)
fs_search_auto_mountpoints(dovecot_t)
fs_list_inotifyfs(dovecot_t)

corecmd_exec_bin(dovecot_t)

domain_use_interactive_fds(dovecot_t)

files_read_etc_files(dovecot_t)
files_search_spool(dovecot_t)
files_search_tmp(dovecot_t)
files_dontaudit_list_default(dovecot_t)
# Dovecot now has quota support and it uses getmntent() to find the mountpoints.
files_read_etc_runtime_files(dovecot_t)
files_search_all_mountpoints(dovecot_t)

init_getattr_utmp(dovecot_t)

auth_use_nsswitch(dovecot_t)

logging_send_syslog_msg(dovecot_t)

miscfiles_read_certs(dovecot_t)
miscfiles_read_localization(dovecot_t)

userdom_dontaudit_use_unpriv_user_fds(dovecot_t)
userdom_manage_user_home_content_dirs(dovecot_t)
userdom_manage_user_home_content_files(dovecot_t)
userdom_manage_user_home_content_symlinks(dovecot_t)
userdom_manage_user_home_content_pipes(dovecot_t)
userdom_manage_user_home_content_sockets(dovecot_t)
userdom_user_home_dir_filetrans_user_home_content(dovecot_t, { dir file lnk_file fifo_file sock_file })

mta_manage_spool(dovecot_t)

optional_policy(`
	kerberos_keytab_template(dovecot, dovecot_t)
')

optional_policy(`
	postgresql_stream_connect(dovecot_t)
')

optional_policy(`
	seutil_sigchld_newrole(dovecot_t)
')

optional_policy(`
	squid_dontaudit_search_cache(dovecot_t)
')

optional_policy(`
	udev_read_db(dovecot_t)
')

########################################
#
# dovecot auth local policy
#

allow dovecot_auth_t self:capability { chown dac_override setgid setuid };
allow dovecot_auth_t self:process { signal_perms getcap setcap };
allow dovecot_auth_t self:fifo_file rw_fifo_file_perms;
allow dovecot_auth_t self:unix_dgram_socket create_socket_perms;
allow dovecot_auth_t self:unix_stream_socket create_stream_socket_perms;

allow dovecot_auth_t dovecot_t:unix_stream_socket { connectto rw_stream_socket_perms };

read_files_pattern(dovecot_auth_t, dovecot_passwd_t, dovecot_passwd_t)

manage_dirs_pattern(dovecot_auth_t, dovecot_auth_tmp_t, dovecot_auth_tmp_t)
manage_files_pattern(dovecot_auth_t, dovecot_auth_tmp_t, dovecot_auth_tmp_t)
files_tmp_filetrans(dovecot_auth_t, dovecot_auth_tmp_t, { file dir })

allow dovecot_auth_t dovecot_var_run_t:dir list_dir_perms;
manage_sock_files_pattern(dovecot_auth_t, dovecot_var_run_t, dovecot_var_run_t)
dovecot_stream_connect_auth(dovecot_auth_t)

kernel_read_all_sysctls(dovecot_auth_t)
kernel_read_system_state(dovecot_auth_t)

logging_send_audit_msgs(dovecot_auth_t)
logging_send_syslog_msg(dovecot_auth_t)

dev_read_urand(dovecot_auth_t)

auth_domtrans_chk_passwd(dovecot_auth_t)
auth_use_nsswitch(dovecot_auth_t)

files_read_etc_files(dovecot_auth_t)
files_read_etc_runtime_files(dovecot_auth_t)
files_search_pids(dovecot_auth_t)
files_read_usr_files(dovecot_auth_t)
files_read_usr_symlinks(dovecot_auth_t)
files_read_var_lib_files(dovecot_auth_t)
files_search_tmp(dovecot_auth_t)
files_read_var_lib_files(dovecot_t)

init_rw_utmp(dovecot_auth_t)

miscfiles_read_localization(dovecot_auth_t)

seutil_dontaudit_search_config(dovecot_auth_t)

optional_policy(`
	kerberos_use(dovecot_auth_t)

	# for gssapi (kerberos)
	userdom_list_user_tmp(dovecot_auth_t)
	userdom_read_user_tmp_files(dovecot_auth_t)
	userdom_read_user_tmp_symlinks(dovecot_auth_t)
')

optional_policy(`
	mysql_search_db(dovecot_auth_t)
	mysql_stream_connect(dovecot_auth_t)
')

optional_policy(`
	nis_authenticate(dovecot_auth_t)
')

optional_policy(`
	postfix_search_spool(dovecot_auth_t)
')

########################################
#
# dovecot deliver local policy
#
allow dovecot_deliver_t self:unix_dgram_socket create_socket_perms;

allow dovecot_deliver_t dovecot_t:process signull;

allow dovecot_deliver_t dovecot_etc_t:file read_file_perms;
allow dovecot_deliver_t dovecot_var_run_t:dir list_dir_perms;

kernel_read_all_sysctls(dovecot_deliver_t)
kernel_read_system_state(dovecot_deliver_t)

files_read_etc_files(dovecot_deliver_t)
files_read_etc_runtime_files(dovecot_deliver_t)

auth_use_nsswitch(dovecot_deliver_t)

logging_send_syslog_msg(dovecot_deliver_t)
logging_search_logs(dovecot_auth_t)

miscfiles_read_localization(dovecot_deliver_t)

dovecot_stream_connect_auth(dovecot_deliver_t)

files_search_tmp(dovecot_deliver_t)

fs_getattr_all_fs(dovecot_deliver_t)

userdom_manage_user_home_content_dirs(dovecot_deliver_t)
userdom_manage_user_home_content_files(dovecot_deliver_t)
userdom_manage_user_home_content_symlinks(dovecot_deliver_t)
userdom_manage_user_home_content_pipes(dovecot_deliver_t)
userdom_manage_user_home_content_sockets(dovecot_deliver_t)
userdom_user_home_dir_filetrans_user_home_content(dovecot_deliver_t, { dir file lnk_file fifo_file sock_file })

tunable_policy(`use_nfs_home_dirs',`
	fs_manage_nfs_dirs(dovecot_deliver_t)
	fs_manage_nfs_files(dovecot_deliver_t)
	fs_manage_nfs_symlinks(dovecot_deliver_t)
	fs_manage_nfs_dirs(dovecot_t)
	fs_manage_nfs_files(dovecot_t)
	fs_manage_nfs_symlinks(dovecot_t)
')

tunable_policy(`use_samba_home_dirs',`
	fs_manage_cifs_dirs(dovecot_deliver_t)
	fs_manage_cifs_files(dovecot_deliver_t)
	fs_manage_cifs_symlinks(dovecot_deliver_t)
	fs_manage_cifs_dirs(dovecot_t)
	fs_manage_cifs_files(dovecot_t)
	fs_manage_cifs_symlinks(dovecot_t)
')

optional_policy(`
	mta_manage_spool(dovecot_deliver_t)
')
add dovecot 2005-10-21 15:38:22 +00:00
Bump module versions for release. 2010-05-24 19:32:01 +00:00			`policy_module(dovecot, 1.12.0)`
add dovecot 2005-10-21 15:38:22 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`
privhome implementation 2005-10-25 17:50:00 +00:00			`type dovecot_t;`
add dovecot 2005-10-21 15:38:22 +00:00			`type dovecot_exec_t;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`init_daemon_domain(dovecot_t, dovecot_exec_t)`
add dovecot 2005-10-21 15:38:22 +00:00
patch from dan Wed, 26 Jul 2006 14:42:46 -0400 2006-07-28 15:13:58 +00:00			`type dovecot_auth_t;`
			`type dovecot_auth_exec_t;`
			`domain_type(dovecot_auth_t)`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`domain_entry_file(dovecot_auth_t, dovecot_auth_exec_t)`
patch from dan Wed, 26 Jul 2006 14:42:46 -0400 2006-07-28 15:13:58 +00:00			`role system_r types dovecot_auth_t;`

trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			`type dovecot_auth_tmp_t;`
			`files_tmp_file(dovecot_auth_tmp_t)`

add dovecot 2005-10-21 15:38:22 +00:00			`type dovecot_cert_t;`
			`files_type(dovecot_cert_t)`

trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			`type dovecot_deliver_t;`
			`type dovecot_deliver_exec_t;`
			`domain_type(dovecot_deliver_t)`
			`domain_entry_file(dovecot_deliver_t, dovecot_deliver_exec_t)`
			`role system_r types dovecot_deliver_t;`

more fix 2005-10-24 18:40:24 +00:00			`type dovecot_etc_t;`
			`files_config_file(dovecot_etc_t)`
add dovecot 2005-10-21 15:38:22 +00:00
trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			`type dovecot_initrc_exec_t;`
			`init_script_file(dovecot_initrc_exec_t)`

add dovecot 2005-10-21 15:38:22 +00:00			`type dovecot_passwd_t;`
			`files_type(dovecot_passwd_t)`

			`type dovecot_spool_t;`
			`files_type(dovecot_spool_t)`

Dovecot patch from Dan Walsh. 2010-05-03 18:37:19 +00:00			`type dovecot_tmp_t;`
			`files_tmp_file(dovecot_tmp_t)`

patch from dan Wed, 26 Jul 2006 14:42:46 -0400 2006-07-28 15:13:58 +00:00			`# /var/lib/dovecot holds SSL parameters file`
			`type dovecot_var_lib_t;`
Dovecot patch from Dan Walsh. 2010-01-07 16:50:47 +00:00			`files_type(dovecot_var_lib_t)`
patch from dan Wed, 26 Jul 2006 14:42:46 -0400 2006-07-28 15:13:58 +00:00
trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			`type dovecot_var_log_t;`
			`logging_log_file(dovecot_var_log_t)`

add dovecot 2005-10-21 15:38:22 +00:00			`type dovecot_var_run_t;`
			`files_pid_file(dovecot_var_run_t)`

			`########################################`
			`#`
			`# dovecot local policy`
			`#`
clean up networkmanager hacks 2005-11-25 16:43:03 +00:00
Dovecot patch from Dan Walsh. 2010-05-03 18:37:19 +00:00			`allow dovecot_t self:capability { dac_override dac_read_search chown kill net_bind_service setgid setuid sys_chroot };`
add dovecot 2005-10-21 15:38:22 +00:00			`dontaudit dovecot_t self:capability sys_tty_config;`
Dovecot patch from Dan Walsh. 2010-01-07 16:50:47 +00:00			`allow dovecot_t self:process { setrlimit signal_perms getcap setcap };`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow dovecot_t self:fifo_file rw_fifo_file_perms;`
add dovecot 2005-10-21 15:38:22 +00:00			`allow dovecot_t self:tcp_socket create_stream_socket_perms;`
			`allow dovecot_t self:unix_dgram_socket create_socket_perms;`
changed rules fixes 2005-11-10 21:37:54 +00:00			`allow dovecot_t self:unix_stream_socket { create_stream_socket_perms connectto };`
add dovecot 2005-10-21 15:38:22 +00:00
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`domtrans_pattern(dovecot_t, dovecot_auth_exec_t, dovecot_auth_t)`
add dovecot 2005-10-21 15:38:22 +00:00
Dovecot patch from Dan Walsh. 2010-05-03 18:37:19 +00:00			`allow dovecot_t dovecot_auth_t:process signal;`

merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow dovecot_t dovecot_cert_t:dir list_dir_perms;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`read_files_pattern(dovecot_t, dovecot_cert_t, dovecot_cert_t)`
			`read_lnk_files_pattern(dovecot_t, dovecot_cert_t, dovecot_cert_t)`
add dovecot 2005-10-21 15:38:22 +00:00
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow dovecot_t dovecot_etc_t:file read_file_perms;`
add dovecot 2005-10-21 15:38:22 +00:00			`files_search_etc(dovecot_t)`

			`can_exec(dovecot_t, dovecot_exec_t)`

Dovecot patch from Dan Walsh. 2010-05-03 18:37:19 +00:00			`manage_dirs_pattern(dovecot_t, dovecot_tmp_t, dovecot_tmp_t)`
			`manage_files_pattern(dovecot_t, dovecot_tmp_t, dovecot_tmp_t)`
			`files_tmp_filetrans(dovecot_t, dovecot_tmp_t, { file dir })`

			`# Allow dovecot to create and read SSL parameters file`
			`manage_files_pattern(dovecot_t, dovecot_var_lib_t, dovecot_var_lib_t)`
			`files_search_var_lib(dovecot_t)`
			`files_read_var_symlinks(dovecot_t)`

			`manage_dirs_pattern(dovecot_t, dovecot_var_log_t, dovecot_var_log_t)`
trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			`manage_files_pattern(dovecot_t, dovecot_var_log_t, dovecot_var_log_t)`
Dovecot patch from Dan Walsh. 2010-05-03 18:37:19 +00:00			`logging_log_filetrans(dovecot_t, dovecot_var_log_t, { file dir })`
trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t)`
			`manage_files_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t)`
			`manage_lnk_files_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t)`
add dovecot 2005-10-21 15:38:22 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(dovecot_t, dovecot_var_run_t, dovecot_var_run_t)`
Dovecot patch from Dan Walsh. 2010-05-03 18:37:19 +00:00			`manage_lnk_files_pattern(dovecot_t, dovecot_var_run_t, dovecot_var_run_t)`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_sock_files_pattern(dovecot_t, dovecot_var_run_t, dovecot_var_run_t)`
			`files_pid_filetrans(dovecot_t, dovecot_var_run_t, file)`
add dovecot 2005-10-21 15:38:22 +00:00
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(dovecot_t)`
add dovecot 2005-10-21 15:38:22 +00:00			`kernel_read_system_state(dovecot_t)`

trunk: Unified labeled networking policy from Paul Moore. The latest revision of the labeled policy patches which enable both labeled and unlabeled policy support for NetLabel. This revision takes into account Chris' feedback from the first version and reduces the number of interface calls in each domain down to two at present: one for unlabeled access, one for NetLabel access. The older, transport layer specific interfaces, are still present for use by third-party modules but are not used in the default policy modules. trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore. This patch changes the policy to use the netmsg initial SID as the "base" SID/context for NetLabel packets which only have MLS security attributes. Currently we use the unlabeled initial SID which makes it very difficult to distinquish between actual unlabeled packets and those packets which have MLS security attributes. 2007-06-27 15:23:21 +00:00			`corenet_all_recvfrom_unlabeled(dovecot_t)`
			`corenet_all_recvfrom_netlabel(dovecot_t)`
trunk: change network interface access from all to generic network interfaces. 2009-01-06 20:24:10 +00:00			`corenet_tcp_sendrecv_generic_if(dovecot_t)`
trunk: Remove node definitions and change node usage to generic nodes. 2009-01-09 19:48:02 +00:00			`corenet_tcp_sendrecv_generic_node(dovecot_t)`
add dovecot 2005-10-21 15:38:22 +00:00			`corenet_tcp_sendrecv_all_ports(dovecot_t)`
trunk: Remove node definitions and change node usage to generic nodes. 2009-01-09 19:48:02 +00:00			`corenet_tcp_bind_generic_node(dovecot_t)`
Dovecot patch from Dan Walsh. 2010-05-03 18:37:19 +00:00			`corenet_tcp_bind_mail_port(dovecot_t)`
more fixes 2005-10-21 21:35:25 +00:00			`corenet_tcp_bind_pop_port(dovecot_t)`
sediff fixes 2005-10-21 19:36:49 +00:00			`corenet_tcp_connect_all_ports(dovecot_t)`
patch from dan Wed, 29 Mar 2006 15:32:51 -0500 2006-03-30 15:59:39 +00:00			`corenet_tcp_connect_postgresql_port(dovecot_t)`
packets 2006-06-02 15:06:45 +00:00			`corenet_sendrecv_pop_server_packets(dovecot_t)`
			`corenet_sendrecv_all_client_packets(dovecot_t)`
add dovecot 2005-10-21 15:38:22 +00:00
			`dev_read_sysfs(dovecot_t)`
			`dev_read_urand(dovecot_t)`

			`fs_getattr_all_fs(dovecot_t)`
Dovecot patch from Dan Walsh. 2010-05-03 18:37:19 +00:00			`fs_getattr_all_dirs(dovecot_t)`
add dovecot 2005-10-21 15:38:22 +00:00			`fs_search_auto_mountpoints(dovecot_t)`
patch from dan Wed, 29 Mar 2006 15:32:51 -0500 2006-03-30 15:59:39 +00:00			`fs_list_inotifyfs(dovecot_t)`
add dovecot 2005-10-21 15:38:22 +00:00
			`corecmd_exec_bin(dovecot_t)`

another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(dovecot_t)`
add dovecot 2005-10-21 15:38:22 +00:00
			`files_read_etc_files(dovecot_t)`
			`files_search_spool(dovecot_t)`
			`files_search_tmp(dovecot_t)`
part of dan's mega patch 2006-01-06 22:51:40 +00:00			`files_dontaudit_list_default(dovecot_t)`
most of patch from dan Mon, 15 May 2006 11:58:01 -0400 2006-05-17 14:50:31 +00:00			`# Dovecot now has quota support and it uses getmntent() to find the mountpoints.`
			`files_read_etc_runtime_files(dovecot_t)`
trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			`files_search_all_mountpoints(dovecot_t)`
add dovecot 2005-10-21 15:38:22 +00:00
Change initrc_var_run_t interface noun from script_pid to utmp for clarity. 2006-01-18 18:08:39 +00:00			`init_getattr_utmp(dovecot_t)`
add dovecot 2005-10-21 15:38:22 +00:00
trunk: clean up nsswitch usage, from dan. 2007-12-04 15:05:55 +00:00			`auth_use_nsswitch(dovecot_t)`

add dovecot 2005-10-21 15:38:22 +00:00			`logging_send_syslog_msg(dovecot_t)`

			`miscfiles_read_certs(dovecot_t)`
			`miscfiles_read_localization(dovecot_t)`

another round of renaming 2006-02-20 21:33:25 +00:00			`userdom_dontaudit_use_unpriv_user_fds(dovecot_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`userdom_manage_user_home_content_dirs(dovecot_t)`
			`userdom_manage_user_home_content_files(dovecot_t)`
			`userdom_manage_user_home_content_symlinks(dovecot_t)`
			`userdom_manage_user_home_content_pipes(dovecot_t)`
			`userdom_manage_user_home_content_sockets(dovecot_t)`
			`userdom_user_home_dir_filetrans_user_home_content(dovecot_t, { dir file lnk_file fifo_file sock_file })`
add dovecot 2005-10-21 15:38:22 +00:00
fix transitions in and out of unconfined. fix bugs uncovered by rawhide testing 2005-11-16 21:08:52 +00:00			`mta_manage_spool(dovecot_t)`
add dovecot 2005-10-21 15:38:22 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			`kerberos_keytab_template(dovecot, dovecot_t)`
add dovecot 2005-10-21 15:38:22 +00:00			`')`

Dovecot patch from Dan Walsh. 2010-05-03 18:37:19 +00:00			optional_policy(`
			`postgresql_stream_connect(dovecot_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add dovecot 2005-10-21 15:38:22 +00:00			`seutil_sigchld_newrole(dovecot_t)`
			`')`

Fixes for squid, dovecot, and snmp from Dan Walsh. 2007-05-07 13:45:17 +00:00			optional_policy(`
			`squid_dontaudit_search_cache(dovecot_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add dovecot 2005-10-21 15:38:22 +00:00			`udev_read_db(dovecot_t)`
			`')`

			`########################################`
			`#`
			`# dovecot auth local policy`
			`#`
clean up networkmanager hacks 2005-11-25 16:43:03 +00:00
trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			`allow dovecot_auth_t self:capability { chown dac_override setgid setuid };`
Dovecot patch from Dan Walsh. 2010-01-07 16:50:47 +00:00			`allow dovecot_auth_t self:process { signal_perms getcap setcap };`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow dovecot_auth_t self:fifo_file rw_fifo_file_perms;`
add dovecot 2005-10-21 15:38:22 +00:00			`allow dovecot_auth_t self:unix_dgram_socket create_socket_perms;`
			`allow dovecot_auth_t self:unix_stream_socket create_stream_socket_perms;`

trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			`allow dovecot_auth_t dovecot_t:unix_stream_socket { connectto rw_stream_socket_perms };`

			`read_files_pattern(dovecot_auth_t, dovecot_passwd_t, dovecot_passwd_t)`
add dovecot 2005-10-21 15:38:22 +00:00
trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			`manage_dirs_pattern(dovecot_auth_t, dovecot_auth_tmp_t, dovecot_auth_tmp_t)`
			`manage_files_pattern(dovecot_auth_t, dovecot_auth_tmp_t, dovecot_auth_tmp_t)`
			`files_tmp_filetrans(dovecot_auth_t, dovecot_auth_tmp_t, { file dir })`
add dovecot 2005-10-21 15:38:22 +00:00
Deprecate some old file and dir permission set macros in favor of the newer, more consistently-named macros. 2007-10-09 17:29:48 +00:00			`allow dovecot_auth_t dovecot_var_run_t:dir list_dir_perms;`
trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			`manage_sock_files_pattern(dovecot_auth_t, dovecot_var_run_t, dovecot_var_run_t)`
			`dovecot_stream_connect_auth(dovecot_auth_t)`
policy-20051208.patch 2005-12-13 20:38:19 +00:00
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_all_sysctls(dovecot_auth_t)`
add dovecot 2005-10-21 15:38:22 +00:00			`kernel_read_system_state(dovecot_auth_t)`

trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			`logging_send_audit_msgs(dovecot_auth_t)`
			`logging_send_syslog_msg(dovecot_auth_t)`

add dovecot 2005-10-21 15:38:22 +00:00			`dev_read_urand(dovecot_auth_t)`

			`auth_domtrans_chk_passwd(dovecot_auth_t)`
patch from dan 2005-11-29 21:51:24 +00:00			`auth_use_nsswitch(dovecot_auth_t)`
add dovecot 2005-10-21 15:38:22 +00:00
			`files_read_etc_files(dovecot_auth_t)`
patch from dan 2005-11-29 21:51:24 +00:00			`files_read_etc_runtime_files(dovecot_auth_t)`
add dovecot 2005-10-21 15:38:22 +00:00			`files_search_pids(dovecot_auth_t)`
trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			`files_read_usr_files(dovecot_auth_t)`
policy-20051208.patch 2005-12-13 20:38:19 +00:00			`files_read_usr_symlinks(dovecot_auth_t)`
Dovecot patch from Dan Walsh. 2010-05-03 18:37:19 +00:00			`files_read_var_lib_files(dovecot_auth_t)`
policy-20051208.patch 2005-12-13 20:38:19 +00:00			`files_search_tmp(dovecot_auth_t)`
patch from dan Thu, 31 Aug 2006 15:16:30 -0400 2006-09-01 15:52:05 +00:00			`files_read_var_lib_files(dovecot_t)`
add dovecot 2005-10-21 15:38:22 +00:00
patch from dan Tue, 24 Oct 2006 11:00:28 -0400 2006-10-31 21:01:48 +00:00			`init_rw_utmp(dovecot_auth_t)`

add dovecot 2005-10-21 15:38:22 +00:00			`miscfiles_read_localization(dovecot_auth_t)`

			`seutil_dontaudit_search_config(dovecot_auth_t)`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add dovecot 2005-10-21 15:38:22 +00:00			`kerberos_use(dovecot_auth_t)`
Dovecot patch from Dan Walsh. 2010-01-07 16:50:47 +00:00
			`# for gssapi (kerberos)`
			`userdom_list_user_tmp(dovecot_auth_t)`
			`userdom_read_user_tmp_files(dovecot_auth_t)`
			`userdom_read_user_tmp_symlinks(dovecot_auth_t)`
add dovecot 2005-10-21 15:38:22 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			`mysql_search_db(dovecot_auth_t)`
			`mysql_stream_connect(dovecot_auth_t)`
			`')`

			optional_policy(`
			`nis_authenticate(dovecot_auth_t)`
			`')`

			optional_policy(`
			`postfix_search_spool(dovecot_auth_t)`
			`')`

			`########################################`
			`#`
			`# dovecot deliver local policy`
			`#`
			`allow dovecot_deliver_t self:unix_dgram_socket create_socket_perms;`

Dovecot patch from Dan Walsh. 2010-05-03 18:37:19 +00:00			`allow dovecot_deliver_t dovecot_t:process signull;`

trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			`allow dovecot_deliver_t dovecot_etc_t:file read_file_perms;`
			`allow dovecot_deliver_t dovecot_var_run_t:dir list_dir_perms;`

			`kernel_read_all_sysctls(dovecot_deliver_t)`
			`kernel_read_system_state(dovecot_deliver_t)`

			`files_read_etc_files(dovecot_deliver_t)`
			`files_read_etc_runtime_files(dovecot_deliver_t)`

			`auth_use_nsswitch(dovecot_deliver_t)`

			`logging_send_syslog_msg(dovecot_deliver_t)`
Dovecot patch from Dan Walsh. 2010-05-03 18:37:19 +00:00			`logging_search_logs(dovecot_auth_t)`
trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00
			`miscfiles_read_localization(dovecot_deliver_t)`

			`dovecot_stream_connect_auth(dovecot_deliver_t)`

			`files_search_tmp(dovecot_deliver_t)`

			`fs_getattr_all_fs(dovecot_deliver_t)`

			`userdom_manage_user_home_content_dirs(dovecot_deliver_t)`
			`userdom_manage_user_home_content_files(dovecot_deliver_t)`
			`userdom_manage_user_home_content_symlinks(dovecot_deliver_t)`
			`userdom_manage_user_home_content_pipes(dovecot_deliver_t)`
			`userdom_manage_user_home_content_sockets(dovecot_deliver_t)`
			`userdom_user_home_dir_filetrans_user_home_content(dovecot_deliver_t, { dir file lnk_file fifo_file sock_file })`

Dovecot patch from Dan Walsh. 2010-01-07 16:50:47 +00:00			tunable_policy(`use_nfs_home_dirs',`
Dovecot patch from Dan Walsh. 2010-05-03 18:37:19 +00:00			`fs_manage_nfs_dirs(dovecot_deliver_t)`
			`fs_manage_nfs_files(dovecot_deliver_t)`
			`fs_manage_nfs_symlinks(dovecot_deliver_t)`
			`fs_manage_nfs_dirs(dovecot_t)`
Dovecot patch from Dan Walsh. 2010-01-07 16:50:47 +00:00			`fs_manage_nfs_files(dovecot_t)`
			`fs_manage_nfs_symlinks(dovecot_t)`
			`')`

			tunable_policy(`use_samba_home_dirs',`
Dovecot patch from Dan Walsh. 2010-05-03 18:37:19 +00:00			`fs_manage_cifs_dirs(dovecot_deliver_t)`
			`fs_manage_cifs_files(dovecot_deliver_t)`
			`fs_manage_cifs_symlinks(dovecot_deliver_t)`
			`fs_manage_cifs_dirs(dovecot_t)`
Dovecot patch from Dan Walsh. 2010-01-07 16:50:47 +00:00			`fs_manage_cifs_files(dovecot_t)`
			`fs_manage_cifs_symlinks(dovecot_t)`
			`')`

trunk: 3 patches from dan. 2009-06-30 19:27:21 +00:00			optional_policy(`
			`mta_manage_spool(dovecot_deliver_t)`
add dovecot 2005-10-21 15:38:22 +00:00			`')`