selinux-policy/policy/modules/services/postfix.if

503 lines
11 KiB
Plaintext
Raw Normal View History

2005-10-23 20:18:36 +00:00
## <summary>Postfix email server</summary>
########################################
## <summary>
## Postfix stub interface. No access allowed.
## </summary>
2008-06-24 14:43:47 +00:00
## <param name="domain" unused="true">
## <summary>
2008-06-24 14:43:47 +00:00
## Domain allowed access.
## </summary>
2005-10-23 20:18:36 +00:00
## </param>
#
interface(`postfix_stub',`
gen_require(`
type postfix_master_t;
')
')
########################################
## <summary>
## Creates types and rules for a basic
## postfix process domain.
## </summary>
## <param name="prefix">
## <summary>
## Prefix for the domain.
## </summary>
## </param>
#
2005-10-23 20:18:36 +00:00
template(`postfix_domain_template',`
type postfix_$1_t;
type postfix_$1_exec_t;
domain_type(postfix_$1_t)
domain_entry_file(postfix_$1_t, postfix_$1_exec_t)
2005-10-23 20:18:36 +00:00
role system_r types postfix_$1_t;
dontaudit postfix_$1_t self:capability sys_tty_config;
allow postfix_$1_t self:process { signal_perms setpgid };
allow postfix_$1_t self:unix_dgram_socket create_socket_perms;
allow postfix_$1_t self:unix_stream_socket create_stream_socket_perms;
allow postfix_$1_t self:unix_stream_socket connectto;
allow postfix_master_t postfix_$1_t:process signal;
2007-09-11 19:24:32 +00:00
#https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=244456
allow postfix_$1_t postfix_master_t:file read;
2005-10-23 20:18:36 +00:00
2006-12-12 20:08:08 +00:00
allow postfix_$1_t postfix_etc_t:dir list_dir_perms;
read_files_pattern(postfix_$1_t, postfix_etc_t, postfix_etc_t)
2005-10-23 20:18:36 +00:00
can_exec(postfix_$1_t, postfix_$1_exec_t)
allow postfix_$1_t postfix_exec_t:file { mmap_file_perms lock ioctl };
2005-10-23 20:18:36 +00:00
allow postfix_$1_t postfix_master_t:process sigchld;
2006-12-12 20:08:08 +00:00
allow postfix_$1_t postfix_spool_t:dir list_dir_perms;
2005-10-23 20:18:36 +00:00
allow postfix_$1_t postfix_var_run_t:file manage_file_perms;
files_pid_filetrans(postfix_$1_t, postfix_var_run_t, file)
2005-10-23 20:18:36 +00:00
kernel_read_system_state(postfix_$1_t)
kernel_read_network_state(postfix_$1_t)
kernel_read_all_sysctls(postfix_$1_t)
2005-10-23 20:18:36 +00:00
dev_read_sysfs(postfix_$1_t)
dev_read_rand(postfix_$1_t)
dev_read_urand(postfix_$1_t)
fs_search_auto_mountpoints(postfix_$1_t)
fs_getattr_xattr_fs(postfix_$1_t)
2007-09-11 19:24:32 +00:00
fs_rw_anon_inodefs_files(postfix_$1_t)
2005-10-23 20:18:36 +00:00
term_dontaudit_use_console(postfix_$1_t)
corecmd_exec_shell(postfix_$1_t)
files_read_etc_files(postfix_$1_t)
files_read_etc_runtime_files(postfix_$1_t)
2005-10-25 00:00:50 +00:00
files_read_usr_symlinks(postfix_$1_t)
2005-10-23 20:18:36 +00:00
files_search_spool(postfix_$1_t)
files_getattr_tmp_dirs(postfix_$1_t)
2005-10-23 20:18:36 +00:00
init_dontaudit_use_fds(postfix_$1_t)
2005-10-23 20:18:36 +00:00
init_sigchld(postfix_$1_t)
auth_use_nsswitch(postfix_$1_t)
2005-10-23 20:18:36 +00:00
logging_send_syslog_msg(postfix_$1_t)
miscfiles_read_localization(postfix_$1_t)
miscfiles_read_certs(postfix_$1_t)
2006-02-20 21:33:25 +00:00
userdom_dontaudit_use_unpriv_user_fds(postfix_$1_t)
2005-10-23 20:18:36 +00:00
optional_policy(`
2005-10-23 20:18:36 +00:00
udev_read_db(postfix_$1_t)
')
')
########################################
## <summary>
## Creates a postfix server process domain.
## </summary>
## <param name="prefix">
## <summary>
## Prefix of the domain.
## </summary>
## </param>
#
2005-10-23 20:18:36 +00:00
template(`postfix_server_domain_template',`
postfix_domain_template($1)
allow postfix_$1_t self:capability { setuid setgid dac_override };
allow postfix_$1_t postfix_master_t:unix_stream_socket { connectto rw_stream_socket_perms };
allow postfix_$1_t self:tcp_socket create_socket_perms;
allow postfix_$1_t self:udp_socket create_socket_perms;
2006-12-12 20:08:08 +00:00
domtrans_pattern(postfix_master_t, postfix_$1_exec_t, postfix_$1_t)
2005-10-23 20:18:36 +00:00
corenet_all_recvfrom_unlabeled(postfix_$1_t)
corenet_all_recvfrom_netlabel(postfix_$1_t)
corenet_tcp_sendrecv_generic_if(postfix_$1_t)
corenet_udp_sendrecv_generic_if(postfix_$1_t)
corenet_tcp_sendrecv_generic_node(postfix_$1_t)
corenet_udp_sendrecv_generic_node(postfix_$1_t)
2005-10-23 20:18:36 +00:00
corenet_tcp_sendrecv_all_ports(postfix_$1_t)
corenet_udp_sendrecv_all_ports(postfix_$1_t)
corenet_tcp_bind_generic_node(postfix_$1_t)
corenet_udp_bind_generic_node(postfix_$1_t)
2005-10-23 20:18:36 +00:00
corenet_tcp_connect_all_ports(postfix_$1_t)
2006-05-30 19:46:34 +00:00
corenet_sendrecv_all_client_packets(postfix_$1_t)
2005-10-23 20:18:36 +00:00
')
########################################
## <summary>
## Creates a process domain for programs
## that are ran by users.
## </summary>
## <param name="prefix">
## <summary>
## Prefix of the domain.
## </summary>
## </param>
#
2005-10-23 20:18:36 +00:00
template(`postfix_user_domain_template',`
2005-12-05 20:18:20 +00:00
gen_require(`
attribute postfix_user_domains, postfix_user_domtrans;
')
2005-10-23 20:18:36 +00:00
postfix_domain_template($1)
2005-12-05 20:18:20 +00:00
typeattribute postfix_$1_t postfix_user_domains;
2005-10-23 20:18:36 +00:00
allow postfix_$1_t self:capability dac_override;
2006-12-12 20:08:08 +00:00
domtrans_pattern(postfix_user_domtrans, postfix_$1_exec_t, postfix_$1_t)
2005-10-23 20:18:36 +00:00
2006-02-20 21:33:25 +00:00
domain_use_interactive_fds(postfix_$1_t)
2005-12-05 20:18:20 +00:00
')
2005-10-23 20:18:36 +00:00
########################################
## <summary>
## Read postfix configuration files.
## </summary>
## <param name="domain">
## <summary>
2005-10-23 20:18:36 +00:00
## Domain allowed access.
## </summary>
2005-10-23 20:18:36 +00:00
## </param>
2006-09-06 22:07:25 +00:00
## <rolecap/>
2005-10-23 20:18:36 +00:00
#
interface(`postfix_read_config',`
gen_require(`
type postfix_etc_t;
')
2008-10-20 16:10:42 +00:00
allow $1 postfix_etc_t:dir list_dir_perms;
allow $1 postfix_etc_t:file read_file_perms;
allow $1 postfix_etc_t:lnk_file read_lnk_file_perms;
2005-10-23 20:18:36 +00:00
files_search_etc($1)
')
2005-11-28 22:19:08 +00:00
########################################
## <summary>
## Create files with the specified type in
## the postfix configuration directories.
## </summary>
## <param name="domain">
## <summary>
2005-11-28 22:19:08 +00:00
## Domain allowed access.
## </summary>
2005-11-28 22:19:08 +00:00
## </param>
## <param name="private type">
## <summary>
2005-11-28 22:19:08 +00:00
## The type of the object to be created.
## </summary>
2005-11-28 22:19:08 +00:00
## </param>
## <param name="object">
## <summary>
## The object class of the object being created.
## </summary>
2005-11-28 22:19:08 +00:00
## </param>
#
2006-02-21 18:40:44 +00:00
interface(`postfix_config_filetrans',`
2005-11-28 22:19:08 +00:00
gen_require(`
type postfix_etc_t;
')
files_search_etc($1)
filetrans_pattern($1, postfix_etc_t, $2, $3)
2005-11-28 22:19:08 +00:00
')
2005-11-15 20:17:18 +00:00
########################################
## <summary>
## Do not audit attempts to read and
## write postfix local delivery
## TCP sockets.
## </summary>
## <param name="domain">
## <summary>
2005-11-15 20:17:18 +00:00
## Domain to not audit.
## </summary>
2005-11-15 20:17:18 +00:00
## </param>
#
2006-02-02 21:08:12 +00:00
interface(`postfix_dontaudit_rw_local_tcp_sockets',`
2005-11-15 20:17:18 +00:00
gen_require(`
type postfix_local_t;
')
dontaudit $1 postfix_local_t:tcp_socket { read write };
')
2007-09-11 19:24:32 +00:00
########################################
## <summary>
## Allow domain to read postfix local process state
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`postfix_read_local_state',`
gen_require(`
type postfix_local_t;
')
read_files_pattern($1, postfix_local_t, postfix_local_t)
2007-09-11 19:24:32 +00:00
')
########################################
## <summary>
## Allow domain to read postfix master process state
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`postfix_read_master_state',`
gen_require(`
type postfix_master_t;
')
read_files_pattern($1, postfix_master_t, postfix_master_t)
2007-09-11 19:24:32 +00:00
')
2005-11-15 20:17:18 +00:00
########################################
## <summary>
## Do not audit attempts to use
## postfix master process file
## file descriptors.
## </summary>
## <param name="domain">
## <summary>
2005-11-15 20:17:18 +00:00
## Domain to not audit.
## </summary>
2005-11-15 20:17:18 +00:00
## </param>
#
interface(`postfix_dontaudit_use_fds',`
2005-11-15 20:17:18 +00:00
gen_require(`
type postfix_master_t;
')
dontaudit $1 postfix_master_t:fd use;
')
2005-10-25 00:00:50 +00:00
########################################
## <summary>
## Execute postfix_map in the postfix_map domain.
## </summary>
## <param name="domain">
## <summary>
2005-10-25 00:00:50 +00:00
## Domain allowed access.
## </summary>
2005-10-25 00:00:50 +00:00
## </param>
#
interface(`postfix_domtrans_map',`
gen_require(`
type postfix_map_t, postfix_map_exec_t;
')
domtrans_pattern($1, postfix_map_exec_t, postfix_map_t)
2005-10-25 00:00:50 +00:00
')
########################################
## <summary>
## Execute postfix_map in the postfix_map domain, and
## allow the specified role the postfix_map domain.
## </summary>
## <param name="domain">
## <summary>
2005-10-25 00:00:50 +00:00
## Domain allowed access.
## </summary>
2005-10-25 00:00:50 +00:00
## </param>
## <param name="role">
## <summary>
2005-10-25 00:00:50 +00:00
## The role to be allowed the postfix_map domain.
## </summary>
2005-10-25 00:00:50 +00:00
## </param>
2006-09-06 22:07:25 +00:00
## <rolecap/>
2005-10-25 00:00:50 +00:00
#
interface(`postfix_run_map',`
gen_require(`
type postfix_map_t;
')
postfix_domtrans_map($1)
role $2 types postfix_map_t;
')
2005-10-23 20:18:36 +00:00
########################################
## <summary>
## Execute the master postfix program in the
## postfix_master domain.
## </summary>
## <param name="domain">
## <summary>
2005-10-23 20:18:36 +00:00
## Domain allowed access.
## </summary>
2005-10-23 20:18:36 +00:00
## </param>
#
interface(`postfix_domtrans_master',`
gen_require(`
type postfix_master_t, postfix_master_exec_t;
')
domtrans_pattern($1, postfix_master_exec_t, postfix_master_t)
2005-10-23 20:18:36 +00:00
')
2005-11-28 22:19:08 +00:00
########################################
## <summary>
## Execute the master postfix program in the
## caller domain.
## </summary>
## <param name="domain">
## <summary>
2005-11-28 22:19:08 +00:00
## Domain allowed access.
## </summary>
2005-11-28 22:19:08 +00:00
## </param>
#
interface(`postfix_exec_master',`
gen_require(`
type postfix_master_exec_t;
')
2009-06-26 14:40:13 +00:00
can_exec($1, postfix_master_exec_t)
2005-11-28 22:19:08 +00:00
')
2007-09-11 19:24:32 +00:00
########################################
## <summary>
## Create a named socket in a postfix private directory.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`postfix_create_pivate_sockets',`
gen_require(`
type postfix_private_t;
')
allow $1 postfix_private_t:dir list_dir_perms;
create_sock_files_pattern($1, postfix_private_t, postfix_private_t)
2007-09-11 19:24:32 +00:00
')
########################################
## <summary>
## Execute the master postfix program in the
## postfix_master domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`postfix_domtrans_smtp',`
gen_require(`
type postfix_smtp_t, postfix_smtp_exec_t;
')
domtrans_pattern($1, postfix_smtp_exec_t, postfix_smtp_t)
')
2005-10-23 20:18:36 +00:00
########################################
## <summary>
## Search postfix mail spool directories.
## </summary>
## <param name="domain">
## <summary>
2005-10-23 20:18:36 +00:00
## Domain allowed access.
## </summary>
2005-10-23 20:18:36 +00:00
## </param>
#
interface(`postfix_search_spool',`
gen_require(`
type postfix_spool_t;
')
allow $1 postfix_spool_t:dir search_dir_perms;
files_search_spool($1)
')
########################################
## <summary>
## List postfix mail spool directories.
## </summary>
## <param name="domain">
## <summary>
2005-10-23 20:18:36 +00:00
## Domain allowed access.
## </summary>
2005-10-23 20:18:36 +00:00
## </param>
#
interface(`postfix_list_spool',`
gen_require(`
type postfix_spool_t;
')
allow $1 postfix_spool_t:dir list_dir_perms;
files_search_spool($1)
')
2005-12-05 20:18:20 +00:00
2007-09-11 19:24:32 +00:00
########################################
## <summary>
## Read postfix mail spool files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`postfix_read_spool_files',`
gen_require(`
type postfix_spool_t;
')
files_search_spool($1)
read_files_pattern($1, postfix_spool_t, postfix_spool_t)
2007-09-11 19:24:32 +00:00
')
2008-12-04 15:01:12 +00:00
########################################
## <summary>
## Create, read, write, and delete postfix mail spool files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`postfix_manage_spool_files',`
gen_require(`
type postfix_spool_t;
')
files_search_spool($1)
manage_files_pattern($1, postfix_spool_t, postfix_spool_t)
')
2005-12-05 20:18:20 +00:00
########################################
## <summary>
## Execute postfix user mail programs
## in their respective domains.
## </summary>
## <param name="domain">
## <summary>
2005-12-05 20:18:20 +00:00
## Domain allowed access.
## </summary>
2005-12-05 20:18:20 +00:00
## </param>
#
interface(`postfix_domtrans_user_mail_handler',`
gen_require(`
attribute postfix_user_domtrans;
')
typeattribute $1 postfix_user_domtrans;
')