selinux-policy/strict/macros/program/evolution_macros.te

#
# Evolution   
#
# Author: Ivan Gyurdiev <ivg2@cornell.edu>
#

################################################
# evolution_common(app_prefix,role_prefix)
# 
define(`evolution_common', `

# Gnome common stuff
gnome_application($1, $2)

# Stat root
allow $1_t root_t:dir search;

# Access null device 
allow $1_t null_device_t:chr_file rw_file_perms;

# FIXME: suppress access to .local/.icons/.themes until properly implemented
dontaudit $1_t $2_home_t:dir r_dir_perms;

# FIXME: suppress access to .gaim/blist.xml (buddy list synchronization)
# until properly implemented
dontaudit $1_t $2_home_t:file r_file_perms;

') dnl evolution_common

#######################################
# evolution_data_server(role_prefix) 
#

define(`evolution_data_server', `

# Type for daemon
type $1_evolution_server_t, domain, nscd_client_domain;

# Transition from user type
if (! disable_evolution_trans) {
domain_auto_trans($1_t, evolution_server_exec_t, $1_evolution_server_t)
}
role $1_r types $1_evolution_server_t;

# Evolution common stuff
evolution_common($1_evolution_server, $1)

# Access evolution home
home_domain_access($1_evolution_server_t, $1, evolution)

# Talks to exchange
bonobo_connect($1_evolution_server, $1_evolution_exchange)

can_exec($1_evolution_server_t, shell_exec_t)

# Obtain weather data via http (read server name from xml file in /usr)
allow $1_evolution_server_t usr_t:file r_file_perms;
can_resolve($1_evolution_server_t)
can_network_client_tcp($1_evolution_server_t, { http_port_t http_cache_port_t } )
allow $1_evolution_server_t { http_cache_port_t http_port_t }:tcp_socket name_connect;

# Talk to ldap (address book)
can_network_client_tcp($1_evolution_server_t, ldap_port_t)
allow $1_evolution_server_t ldap_port_t:tcp_socket name_connect;

# Look in /etc/pki
r_dir_file($1_evolution_server_t, cert_t)

') dnl evolution_data_server

#######################################
# evolution_webcal(role_prefix)
#

define(`evolution_webcal', `

# Type for program
type $1_evolution_webcal_t, domain, nscd_client_domain;

# Transition from user type
domain_auto_trans($1_t, evolution_webcal_exec_t, $1_evolution_webcal_t)
role $1_r types $1_evolution_webcal_t;

# X/evolution common stuff
x_client_domain($1_evolution_webcal, $1)
evolution_common($1_evolution_webcal, $1)

# Search home directory (?)
allow $1_evolution_webcal_t $1_home_dir_t:dir search;

# Networking capability - connect to website and handle ics link
# FIXME: is this necessary ?
can_resolve($1_evolution_webcal_t);
can_network_client_tcp($1_evolution_webcal_t, { http_port_t http_cache_port_t } )
allow $1_evolution_webcal_t { http_cache_port_t http_port_t } :tcp_socket name_connect;
  
') dnl evolution_webcal

#######################################
# evolution_alarm(role_prefix)
#
define(`evolution_alarm', `

# Type for program
type $1_evolution_alarm_t, domain, nscd_client_domain;

# Transition from user type
domain_auto_trans($1_t, evolution_alarm_exec_t, $1_evolution_alarm_t)
role $1_r types $1_evolution_alarm_t;

# Common evolution stuff, X
evolution_common($1_evolution_alarm, $1)
x_client_domain($1_evolution_alarm, $1)

# Connect to exchange, e-d-s
bonobo_connect($1_evolution_alarm, $1_evolution_server) 
bonobo_connect($1_evolution_alarm, $1_evolution_exchange)

# Access evolution home
home_domain_access($1_evolution_alarm_t, $1, evolution)

') dnl evolution_alarm

########################################
# evolution_exchange(role_prefix)
#
define(`evolution_exchange', `

# Type for program
type $1_evolution_exchange_t, domain, nscd_client_domain;

# Transition from user type
domain_auto_trans($1_t, evolution_exchange_exec_t, $1_evolution_exchange_t)
role $1_r types $1_evolution_exchange_t;

# Common evolution stuff, X
evolution_common($1_evolution_exchange, $1)
x_client_domain($1_evolution_exchange, $1)

# Access evolution home
home_domain_access($1_evolution_exchange_t, $1, evolution)

# /tmp/.exchange-$USER
tmp_domain($1_evolution_exchange)
 
# Allow netstat
allow $1_evolution_exchange_t bin_t:dir search; 
can_exec($1_evolution_exchange_t, bin_t)
r_dir_file($1_evolution_exchange_t, proc_net_t)
allow $1_evolution_exchange_t sysctl_net_t:dir search;
allow $1_evolution_exchange_t self:{ udp_socket tcp_socket } create_socket_perms;

# Clock applet talks to exchange (FIXME: Needs policy)
bonobo_connect($1, $1_evolution_exchange)

# FIXME: policy incomplete

') dnl evolution_exchange

#######################################
# evolution_domain(role_prefix)
#

define(`evolution_domain', `

# Type for program
type $1_evolution_t, domain, nscd_client_domain, privlog; 

# Transition from user type
domain_auto_trans($1_t, evolution_exec_t, $1_evolution_t)
role $1_r types $1_evolution_t;

# X, mail, evolution common stuff 
x_client_domain($1_evolution, $1)
mail_client_domain($1_evolution, $1)
gnome_file_dialog($1_evolution, $1)
evolution_common($1_evolution, $1)

# Connect to e-d-s, exchange, alarm
bonobo_connect($1_evolution, $1_evolution_server)
bonobo_connect($1_evolution, $1_evolution_exchange)
bonobo_connect($1_evolution, $1_evolution_alarm)

# Access .evolution
home_domain($1, evolution)

# Store passwords in .gnome2_private
gnome_private_store($1_evolution, $1) 

# Run various programs
allow $1_evolution_t { bin_t sbin_t }:dir r_dir_perms;
allow $1_evolution_t { self bin_t }:lnk_file r_file_perms;

### Junk mail filtering (start spamd)
ifdef(`spamd.te', `
# Start the spam daemon
domain_auto_trans($1_evolution_t, spamd_exec_t, spamd_t)
role $1_r types spamd_t;

# Write pid file and socket in ~/.evolution/cache/tmp
file_type_auto_trans(spamd_t, $1_evolution_home_t, spamd_tmp_t, { file sock_file })

# Allow evolution to signal the daemon
# FIXME: Now evolution can read spamd temp files
allow $1_evolution_t spamd_tmp_t:file r_file_perms;
allow $1_evolution_t spamd_t:process signal;
dontaudit $1_evolution_t spamd_tmp_t:sock_file getattr;
') dnl spamd.te

### Junk mail filtering (start spamc)
ifdef(`spamc.te', `
domain_auto_trans($1_evolution_t, spamc_exec_t, $1_spamc_t)

# Allow connection to spamd socket above
allow $1_spamc_t $1_evolution_home_t:dir search;
') dnl spamc.te

### Junk mail filtering (start spamassassin) 
ifdef(`spamassassin.te', `
domain_auto_trans($1_evolution_t, spamassassin_exec_t, $1_spamassassin_t)
') dnl spamassasin.te

') dnl evolution_domain

#################################
#  evolution_domains(role_prefix) 

define(`evolution_domains', `
evolution_domain($1)
evolution_data_server($1)
evolution_webcal($1)
evolution_alarm($1)
evolution_exchange($1)
') dnl end evolution_domains