rpms/selinux-policy
6
0
Fork 0
Code Issues Pull Requests Releases Activity

MTA patch from Dan Walsh.

Browse Source
This commit is contained in:
Chris PeBenito 2010-01-07 09:48:35 -05:00
parent 2650ca57ec
commit 9c40673ff5
3 changed files with 40 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
policy/modules/services/mta.fc
View File

@ -1,15 +1,17 @@
HOME_DIR/\.forward -- gen_context(system_u:object_r:mail_forward_t,s0)
/bin/mail(x)? -- gen_context(system_u:object_r:sendmail_exec_t,s0) /bin/mail(x)? -- gen_context(system_u:object_r:sendmail_exec_t,s0)
/etc/aliases -- gen_context(system_u:object_r:etc_aliases_t,s0) /etc/aliases -- gen_context(system_u:object_r:etc_aliases_t,s0)
/etc/aliases\.db -- gen_context(system_u:object_r:etc_aliases_t,s0) /etc/aliases\.db -- gen_context(system_u:object_r:etc_aliases_t,s0)
/etc/mail(/.*)? gen_context(system_u:object_r:etc_mail_t,s0) /etc/mail(/.*)? gen_context(system_u:object_r:etc_mail_t,s0)
/etc/mail/aliases -- gen_context(system_u:object_r:etc_aliases_t,s0) /etc/mail/aliases -- gen_context(system_u:object_r:etc_aliases_t,s0)
/etc/mail/aliases\.db -- gen_context(system_u:object_r:etc_aliases_t,s0) /etc/mail/aliases\.db -- gen_context(system_u:object_r:etc_aliases_t,s0)
ifdef(`distro_redhat',` ifdef(`distro_redhat',`
/etc/postfix/aliases.* gen_context(system_u:object_r:etc_aliases_t,s0) /etc/postfix/aliases.* gen_context(system_u:object_r:etc_aliases_t,s0)
') ')
/usr/bin/esmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0) /usr/bin/esmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0)
/usr/lib(64)?/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) /usr/lib(64)?/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0)
/usr/lib/courier/bin/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) /usr/lib/courier/bin/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0)

10
policy/modules/services/mta.if
View File

@ -69,6 +69,7 @@ template(`mta_base_mail_template',`
can_exec($1_mail_t, sendmail_exec_t) can_exec($1_mail_t, sendmail_exec_t)
allow $1_mail_t sendmail_exec_t:lnk_file read_lnk_file_perms; allow $1_mail_t sendmail_exec_t:lnk_file read_lnk_file_perms;
kernel_read_system_state($1_mail_t)
kernel_read_kernel_sysctls($1_mail_t) kernel_read_kernel_sysctls($1_mail_t)
corenet_all_recvfrom_unlabeled($1_mail_t) corenet_all_recvfrom_unlabeled($1_mail_t)
@ -89,6 +90,8 @@ template(`mta_base_mail_template',`
auth_use_nsswitch($1_mail_t) auth_use_nsswitch($1_mail_t)
init_dontaudit_rw_utmp($1_mail_t)
logging_send_syslog_msg($1_mail_t) logging_send_syslog_msg($1_mail_t)
miscfiles_read_localization($1_mail_t) miscfiles_read_localization($1_mail_t)
@ -193,7 +196,7 @@ interface(`mta_mailserver',`
attribute mailserver_domain; attribute mailserver_domain;
') ')
init_daemon_domain($1,$2) init_daemon_domain($1, $2)
typeattribute $1 mailserver_domain; typeattribute $1 mailserver_domain;
') ')
@ -311,6 +314,7 @@ interface(`mta_mailserver_delivery',`
allow $1 mail_spool_t:dir list_dir_perms; allow $1 mail_spool_t:dir list_dir_perms;
create_files_pattern($1, mail_spool_t, mail_spool_t) create_files_pattern($1, mail_spool_t, mail_spool_t)
read_files_pattern($1, mail_spool_t, mail_spool_t) read_files_pattern($1, mail_spool_t, mail_spool_t)
append_files_pattern($1, mail_spool_t, mail_spool_t)
create_lnk_files_pattern($1, mail_spool_t, mail_spool_t) create_lnk_files_pattern($1, mail_spool_t, mail_spool_t)
read_lnk_files_pattern($1, mail_spool_t, mail_spool_t) read_lnk_files_pattern($1, mail_spool_t, mail_spool_t)
@ -376,7 +380,7 @@ interface(`mta_send_mail',`
allow mta_user_agent $1:fd use; allow mta_user_agent $1:fd use;
allow mta_user_agent $1:process sigchld; allow mta_user_agent $1:process sigchld;
allow mta_user_agent $1:fifo_file { read write }; allow mta_user_agent $1:fifo_file rw_fifo_file_perms;
') ')
######################################## ########################################
@ -648,7 +652,7 @@ interface(`mta_dontaudit_getattr_spool_files',`
####################################### #######################################
## <summary> ## <summary>
## Create private objects in the ## Create private objects in the
## mail spool directory. ## mail spool directory.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">

30
policy/modules/services/mta.te
View File

@ -1,5 +1,5 @@
policy_module(mta, 2.2.0) policy_module(mta, 2.2.1)
######################################## ########################################
# #
@ -21,6 +21,9 @@ files_type(etc_aliases_t)
type etc_mail_t; type etc_mail_t;
files_config_file(etc_mail_t) files_config_file(etc_mail_t)
type mail_forward_t;
files_type(mail_forward_t)
type mqueue_spool_t; type mqueue_spool_t;
files_mountpoint(mqueue_spool_t) files_mountpoint(mqueue_spool_t)
@ -51,14 +54,18 @@ allow system_mail_t self:capability { dac_override fowner };
allow system_mail_t self:fifo_file rw_fifo_file_perms; allow system_mail_t self:fifo_file rw_fifo_file_perms;
read_files_pattern(system_mail_t, etc_mail_t, etc_mail_t) read_files_pattern(system_mail_t, etc_mail_t, etc_mail_t)
read_files_pattern(system_mail_t, mailcontent_type, mailcontent_type) read_files_pattern(system_mail_t, mailcontent_type, mailcontent_type)
allow system_mail_t mail_forward_t:file read_file_perms;
allow system_mail_t mta_exec_type:file entrypoint; allow system_mail_t mta_exec_type:file entrypoint;
can_exec(system_mail_t, mta_exec_type) can_exec(system_mail_t, mta_exec_type)
kernel_read_system_state(system_mail_t) kernel_read_system_state(system_mail_t)
kernel_read_network_state(system_mail_t) kernel_read_network_state(system_mail_t)
kernel_request_load_module(system_mail_t)
dev_read_sysfs(system_mail_t) dev_read_sysfs(system_mail_t)
dev_read_rand(system_mail_t) dev_read_rand(system_mail_t)
@ -197,6 +204,27 @@ optional_policy(`
') ')
') ')
########################################
#
# Mailserver delivery local policy
#
read_files_pattern(mailserver_delivery, mail_forward_t, mail_forward_t)
read_files_pattern(mailserver_delivery, system_mail_tmp_t, system_mail_tmp_t)
tunable_policy(`use_samba_home_dirs',`
fs_manage_cifs_dirs(mailserver_delivery)
fs_manage_cifs_files(mailserver_delivery)
fs_manage_cifs_symlinks(mailserver_delivery)
')
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(mailserver_delivery)
fs_manage_nfs_files(mailserver_delivery)
fs_manage_nfs_symlinks(mailserver_delivery)
')
######################################## ########################################
# #
# User send mail local policy # User send mail local policy