86 lines
2.6 KiB
Plaintext
86 lines
2.6 KiB
Plaintext
|
#DESC Amavis - Anti-virus
|
||
|
|
#
|
||
|
|
# Author: Brian May <bam@snoopy.apana.org.au>
|
||
|
|
# X-Debian-Packages: amavis-ng amavisd-new amavisd-new-milter amavisd-new-milter-helper
|
||
|
|
# Depends: clamav.te
|
||
|
|
#
|
||
|
|
|
||
|
|
#################################
|
||
|
|
#
|
||
|
|
# Rules for the amavisd_t domain.
|
||
|
|
#
|
||
|
|
type amavisd_etc_t, file_type, sysadmfile;
|
||
|
|
type amavisd_lib_t, file_type, sysadmfile;
|
||
|
|
|
||
|
|
type amavis_port_t, port_type;
|
||
|
|
daemon_domain(amavisd)
|
||
|
|
tmp_domain(amavisd)
|
||
|
|
|
||
|
|
allow initrc_t amavisd_lib_t:dir { search read write rmdir remove_name unlink };
|
||
|
|
allow initrc_t amavisd_lib_t:file unlink;
|
||
|
|
allow initrc_t amavisd_var_run_t:dir setattr;
|
||
|
|
allow amavisd_t self:capability { chown dac_override setgid setuid };
|
||
|
|
dontaudit amavisd_t self:capability sys_tty_config;
|
||
|
|
|
||
|
|
allow amavisd_t usr_t:{ file lnk_file } { getattr read };
|
||
|
|
dontaudit amavisd_t usr_t:file ioctl;
|
||
|
|
|
||
|
|
# networking
|
||
|
|
can_network(amavisd_t)
|
||
|
|
can_ypbind(amavisd_t);
|
||
|
|
can_tcp_connect(mail_server_sender, amavisd_t);
|
||
|
|
can_tcp_connect(amavisd_t, mail_server_domain)
|
||
|
|
allow amavisd_t amavis_port_t:tcp_socket name_bind;
|
||
|
|
|
||
|
|
ifdef(`scannerdaemon.te', `
|
||
|
|
can_tcp_connect(amavisd_t, scannerdaemon_t);
|
||
|
|
allow scannerdaemon_t amavisd_lib_t:dir r_dir_perms;
|
||
|
|
allow scannerdaemon_t amavisd_lib_t:file r_file_perms;
|
||
|
|
')
|
||
|
|
|
||
|
|
ifdef(`clamav.te', `
|
||
|
|
clamscan_domain(amavisd)
|
||
|
|
role system_r types amavisd_clamscan_t;
|
||
|
|
domain_auto_trans(amavisd_t, clamscan_exec_t, amavisd_clamscan_t)
|
||
|
|
allow amavisd_clamscan_t amavisd_lib_t:dir r_dir_perms;
|
||
|
|
allow amavisd_clamscan_t amavisd_lib_t:file r_file_perms;
|
||
|
|
can_clamd_connect(amavisd)
|
||
|
|
allow clamd_t amavisd_lib_t:dir r_dir_perms;
|
||
|
|
allow clamd_t amavisd_lib_t:file r_file_perms;
|
||
|
|
')
|
||
|
|
|
||
|
|
# Can create unix sockets
|
||
|
|
allow amavisd_t self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
allow amavisd_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
allow amavisd_t self:fifo_file getattr;
|
||
|
|
|
||
|
|
read_locale(amavisd_t)
|
||
|
|
|
||
|
|
# Access config files (amavisd).
|
||
|
|
allow amavisd_t amavisd_etc_t:file r_file_perms;
|
||
|
|
|
||
|
|
log_domain(amavisd)
|
||
|
|
|
||
|
|
# Access amavisd var/lib files.
|
||
|
|
create_dir_file(amavisd_t, amavisd_lib_t)
|
||
|
|
|
||
|
|
# Run helper programs.
|
||
|
|
can_exec_any(amavisd_t,bin_t)
|
||
|
|
allow amavisd_t bin_t:dir { getattr search };
|
||
|
|
allow amavisd_t sbin_t:dir search;
|
||
|
|
allow amavisd_t var_lib_t:dir search;
|
||
|
|
|
||
|
|
# allow access to files for scanning (required for amavis):
|
||
|
|
allow clamd_t self:capability { dac_override dac_read_search };
|
||
|
|
|
||
|
|
# unknown stuff
|
||
|
|
allow amavisd_t self:fifo_file { ioctl read write };
|
||
|
|
allow amavisd_t { random_device_t urandom_device_t }:chr_file read;
|
||
|
|
allow amavisd_t proc_t:file { getattr read };
|
||
|
|
allow amavisd_t etc_runtime_t:file { getattr read };
|
||
|
|
|
||
|
|
# broken stuff
|
||
|
|
dontaudit amavisd_t sysadm_home_dir_t:dir search;
|
||
|
|
dontaudit amavisd_t shadow_t:file { getattr read };
|
||
|
|
dontaudit amavisd_t sysadm_devpts_t:chr_file { read write };
|