310 lines
8.9 KiB
Plaintext
310 lines
8.9 KiB
Plaintext
|
#DESC Exim - Mail server
|
||
|
|
#
|
||
|
|
# Author: David Hampton <hampton@employees.org>
|
||
|
|
# From postfix.te by Russell Coker <russell@coker.com.au>
|
||
|
|
# Depends: mta.te
|
||
|
|
#
|
||
|
|
|
||
|
|
type exim_spool_t, file_type, sysadmfile;
|
||
|
|
type exim_spool_db_t, file_type, sysadmfile;
|
||
|
|
|
||
|
|
|
||
|
|
##########
|
||
|
|
# Exim daemon
|
||
|
|
##########
|
||
|
|
daemon_domain(exim, `, mta_delivery_agent, mail_server_domain, mail_server_sender, nscd_client_domain, privlog, privhome', nosysadm)
|
||
|
|
exim_common(exim);
|
||
|
|
etcdir_domain(exim)
|
||
|
|
logdir_domain(exim)
|
||
|
|
########################################
|
||
|
|
########################################
|
||
|
|
role sysadm_r types exim_t;
|
||
|
|
|
||
|
|
# Server side networking
|
||
|
|
can_network_tcp(exim_t);
|
||
|
|
allow exim_t { smtp_port_t amavisd_send_port_t }:tcp_socket name_bind;
|
||
|
|
# The exim daemon gets to listen to mail coming back from amavisd
|
||
|
|
# For identd lookups
|
||
|
|
allow exim_t inetd_child_port_t:tcp_socket name_connect;
|
||
|
|
allow exim_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
|
||
|
|
# Lock file between exim processes. Exim creates a lock file in /tmp
|
||
|
|
# that doesn't transition to the exim_tmp_t domain for some reason,
|
||
|
|
# thus the allow statement.
|
||
|
|
tmp_domain(exim)
|
||
|
|
allow exim_t tmp_t:file { getattr read };
|
||
|
|
|
||
|
|
# Lock files for the actual mail delivery. Exim wants to create a
|
||
|
|
# 'hitching post' file in the same directory as the delivery file.
|
||
|
|
# These are the additiona privileges over and above what's defined for
|
||
|
|
# an mta_delivery_agent. Additional privs for maildir mail files
|
||
|
|
allow exim_t mail_spool_t:dir remove_name;
|
||
|
|
allow exim_t mail_spool_t:file { link setattr unlink write rename };
|
||
|
|
|
||
|
|
# For access to users .forward files
|
||
|
|
allow exim_t home_dir_type:dir { getattr search };
|
||
|
|
|
||
|
|
allow exim_t self:capability { dac_read_search net_bind_service };
|
||
|
|
|
||
|
|
# Create exim spool files, update spool database
|
||
|
|
create_dir_file(exim_t, exim_spool_t)
|
||
|
|
rw_dir_file(exim_t, exim_spool_db_t)
|
||
|
|
|
||
|
|
# Start daemon/child processes
|
||
|
|
can_exec(exim_t, exim_exec_t)
|
||
|
|
|
||
|
|
allow exim_t sbin_t:dir r_dir_perms;
|
||
|
|
|
||
|
|
# Read aliases file
|
||
|
|
allow exim_t etc_aliases_t:file r_file_perms;
|
||
|
|
|
||
|
|
#
|
||
|
|
allow exim_t devpts_t:chr_file getattr;
|
||
|
|
|
||
|
|
ifdef(`crond.te', `
|
||
|
|
system_crond_entry(exim_exec_t, exim_t)
|
||
|
|
domain_auto_trans(crond_t, exim_exec_t, exim_t)
|
||
|
|
allow exim_t system_crond_tmp_t:file { getattr read append };
|
||
|
|
#logwatch
|
||
|
|
allow system_crond_t exim_log_t:file read;
|
||
|
|
')
|
||
|
|
|
||
|
|
# For squirrelmail
|
||
|
|
ifdef(`httpd.te', `
|
||
|
|
domain_auto_trans(httpd_sys_script_t, exim_exec_t, exim_t)
|
||
|
|
allow exim_t httpd_t:fd use;
|
||
|
|
allow exim_t httpd_t:process sigchld;
|
||
|
|
allow exim_t httpd_log_t:file { append getattr };
|
||
|
|
allow exim_t httpd_squirrelmail_t:file { append read };
|
||
|
|
allow exim_t httpd_t:fifo_file { read write getattr };
|
||
|
|
allow exim_t httpd_t:tcp_socket { read write };
|
||
|
|
')
|
||
|
|
|
||
|
|
########################################
|
||
|
|
########################################
|
||
|
|
|
||
|
|
|
||
|
|
## --------------------------------------------------
|
||
|
|
## exim_ro, exim_ro_net
|
||
|
|
##
|
||
|
|
## Many of the subsequent applications call exim for
|
||
|
|
## the sole purpose of extracting configuration or
|
||
|
|
## other information. Lock down the permissions on
|
||
|
|
## these instances to be pretty much read-only
|
||
|
|
## everything.
|
||
|
|
##
|
||
|
|
## One of the applications calls exim only to
|
||
|
|
## determine whether an address is valid. It does
|
||
|
|
## this by having exim attempt to deliver an empty
|
||
|
|
## message, without doing the actual deliver.
|
||
|
|
## These function are aplit out here to keep all the
|
||
|
|
## access controls on exim itself in poe part of the
|
||
|
|
## file.
|
||
|
|
## --------------------------------------------------
|
||
|
|
|
||
|
|
define(`exim_ro_base', `
|
||
|
|
application_domain($1)
|
||
|
|
role system_r types $1_t;
|
||
|
|
read_sysctl($1_t)
|
||
|
|
r_dir_file($1_t, etc_t) #for nsswitch.conf
|
||
|
|
r_dir_file($1_t, var_spool_t)
|
||
|
|
r_dir_file($1_t, exim_spool_t)
|
||
|
|
allow $1_t devpts_t:chr_file { getattr read write };
|
||
|
|
allow $1_t self:capability { dac_override setgid setuid };
|
||
|
|
')
|
||
|
|
|
||
|
|
exim_ro_base(exim_ro)
|
||
|
|
dontaudit exim_ro_t self:unix_stream_socket { connect create };
|
||
|
|
|
||
|
|
exim_ro_base(exim_ro_net)
|
||
|
|
can_network(exim_ro_net_t)
|
||
|
|
general_proc_read_access(exim_ro_net_t)
|
||
|
|
read_locale(exim_ro_net_t)
|
||
|
|
allow exim_ro_net_t mail_spool_t:dir search;
|
||
|
|
allow exim_ro_net_t etc_aliases_t:file r_file_perms;
|
||
|
|
allow exim_ro_net_t self:unix_stream_socket { create connect };
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
## --------------------------------------------------
|
||
|
|
## exim_helper_base
|
||
|
|
##
|
||
|
|
## Define the base attributes for an exim helper
|
||
|
|
## program.
|
||
|
|
## --------------------------------------------------
|
||
|
|
define(`exim_helper_base',`
|
||
|
|
application_domain($1)
|
||
|
|
role system_r types $1_t;
|
||
|
|
can_exec_any($1_t)
|
||
|
|
|
||
|
|
allow $1_t devpts_t:dir search;
|
||
|
|
|
||
|
|
# Needed for perl
|
||
|
|
general_domain_access($1_t)
|
||
|
|
general_proc_read_access($1_t)
|
||
|
|
allow $1_t urandom_device_t:chr_file read;
|
||
|
|
allow $1_t { devtty_t devpts_t }:chr_file { read write ioctl };
|
||
|
|
read_locale($1_t)
|
||
|
|
allow $1_t sbin_t:dir r_dir_perms;
|
||
|
|
')
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
## --------------------------------------------------
|
||
|
|
## exim_helper_script_base
|
||
|
|
## --------------------------------------------------
|
||
|
|
define(`exim_helper_script_base',`
|
||
|
|
exim_helper_base($1)
|
||
|
|
|
||
|
|
# Needed for bash
|
||
|
|
allow $1_t { devtty_t devpts_t }:chr_file { read write getattr };
|
||
|
|
allow $1_t devpts_t:dir search;
|
||
|
|
allow $1_t fs_t:filesystem getattr;
|
||
|
|
rw_dir_create_file($1_t, tmp_t) # Script uses a "here" document
|
||
|
|
dontaudit $1_t etc_runtime_t:file { getattr read }; # mtab
|
||
|
|
dontaudit $1_t selinux_config_t:dir { search };
|
||
|
|
dontaudit $1_t selinux_config_t:file { getattr read }; # mtab
|
||
|
|
allow $1_t var_spool_t:dir search; # Needed to traverse to get to /var/spool/exim
|
||
|
|
|
||
|
|
')
|
||
|
|
|
||
|
|
|
||
|
|
## --------------------------------------------------
|
||
|
|
## exicyclog
|
||
|
|
## --------------------------------------------------
|
||
|
|
|
||
|
|
exim_helper_script_base(exicyclog)
|
||
|
|
allow exicyclog_t self:capability { dac_override setuid setgid };
|
||
|
|
create_dir_file(exicyclog_t, exim_log_t)
|
||
|
|
allow exicyclog_t var_t:dir r_dir_perms;
|
||
|
|
allow exicyclog_t var_log_t:dir r_dir_perms;
|
||
|
|
allow exicyclog_t exim_spool_t:dir r_dir_perms;
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
## --------------------------------------------------
|
||
|
|
## exigrep
|
||
|
|
## --------------------------------------------------
|
||
|
|
|
||
|
|
exim_helper_base(exigrep)
|
||
|
|
allow exigrep_t self:capability dac_override;
|
||
|
|
r_dir_file(exigrep_t, var_log_t)
|
||
|
|
r_dir_file(exigrep_t, exim_log_t)
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
## --------------------------------------------------
|
||
|
|
## exipick
|
||
|
|
## --------------------------------------------------
|
||
|
|
|
||
|
|
exim_helper_base(exipick)
|
||
|
|
domain_auto_trans(exipick_t, exim_exec_t, exim_ro_t)
|
||
|
|
r_dir_file(exipick_t, var_spool_t)
|
||
|
|
r_dir_file(exipick_t, exim_spool_t)
|
||
|
|
allow exipick_t self:capability dac_override;
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
## --------------------------------------------------
|
||
|
|
## exiqgrep
|
||
|
|
## --------------------------------------------------
|
||
|
|
|
||
|
|
exim_helper_base(exiqgrep)
|
||
|
|
domain_auto_trans(exiqgrep_t, exim_exec_t, exim_ro_t)
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
application_domain(exim_lock)
|
||
|
|
role system_r types exim_lock_t;
|
||
|
|
|
||
|
|
|
||
|
|
## --------------------------------------------------
|
||
|
|
## exiwhat
|
||
|
|
## 1) Runs exim to extract config info
|
||
|
|
## 2) Sends a signal to all running exim processes
|
||
|
|
## 3) Collects the status files they drop in the spool directory
|
||
|
|
## --------------------------------------------------
|
||
|
|
|
||
|
|
exim_helper_script_base(exiwhat)
|
||
|
|
domain_auto_trans(exiwhat_t, exim_exec_t, exim_ro_t)
|
||
|
|
allow exiwhat_t exim_spool_t:dir { rw_dir_perms };
|
||
|
|
allow exiwhat_t exim_spool_t:file { r_file_perms unlink };
|
||
|
|
|
||
|
|
# killall
|
||
|
|
r_dir_file(exiwhat_t, exim_t)
|
||
|
|
r_dir_file(exiwhat_t, selinux_config_t)
|
||
|
|
allow exiwhat_t exim_t:process signal;
|
||
|
|
allow exiwhat_t self:capability { dac_override kill sys_nice };
|
||
|
|
|
||
|
|
dontaudit exiwhat_t file_type:dir search;
|
||
|
|
dontaudit exiwhat_t file_type:file { getattr read };
|
||
|
|
|
||
|
|
# rm
|
||
|
|
allow exiwhat_t devpts_t:chr_file ioctl;
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
## --------------------------------------------------
|
||
|
|
## exim_check_access
|
||
|
|
## 1) Runs exim to simulate mail receipt
|
||
|
|
## 2) Checks on whether the mail address is allowed from the ip address
|
||
|
|
## --------------------------------------------------
|
||
|
|
|
||
|
|
exim_helper_script_base(exim_checkaccess)
|
||
|
|
domain_auto_trans(exim_checkaccess_t, exim_exec_t, exim_ro_net_t)
|
||
|
|
allow exim_checkaccess_t exim_spool_t:dir { r_dir_perms };
|
||
|
|
allow exim_checkaccess_t self:capability dac_override;
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
## --------------------------------------------------
|
||
|
|
## exim_helper
|
||
|
|
## --------------------------------------------------
|
||
|
|
application_domain(exim_helper)
|
||
|
|
domain_auto_trans(exim_helper_t, exim_exec_t, exim_ro_t)
|
||
|
|
can_exec(exim_helper_t, bin_t)
|
||
|
|
role system_r types exim_helper_t;
|
||
|
|
general_domain_access(exim_helper_t)
|
||
|
|
read_locale(exim_helper_t)
|
||
|
|
|
||
|
|
allow exim_helper_t { devtty_t devpts_t }:chr_file { read write };
|
||
|
|
|
||
|
|
# Have to walk through /var/log to get to /var/log/exim
|
||
|
|
allow exim_helper_t var_t:dir r_dir_perms;
|
||
|
|
r_dir_file(exim_helper_t, exim_log_t)
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
## --------------------------------------------------
|
||
|
|
## exim database maintenance programs
|
||
|
|
## exim_dump_db, exim_fixdb, exim_tidydb
|
||
|
|
## --------------------------------------------------
|
||
|
|
define(`exim_db_base',`
|
||
|
|
application_domain($1)
|
||
|
|
role system_r types $1_t;
|
||
|
|
read_locale($1_t)
|
||
|
|
general_proc_read_access($1_t)
|
||
|
|
allow $1_t devpts_t:chr_file { getattr read write };
|
||
|
|
allow $1_t self:capability { dac_override setgid setuid };
|
||
|
|
allow $1_t tmp_t:dir { getattr };
|
||
|
|
r_dir_file($1_t, var_spool_t)
|
||
|
|
r_dir_file($1_t, exim_spool_t)
|
||
|
|
r_dir_file($1_t, exim_spool_db_t)
|
||
|
|
dontaudit $1_t etc_runtime_t:file { getattr read }; # mtab
|
||
|
|
')
|
||
|
|
|
||
|
|
exim_db_base(exim_db_ro)
|
||
|
|
exim_db_base(exim_db_rw)
|
||
|
|
rw_dir_file(exim_db_rw_t, exim_spool_db_t)
|