rpms/selinux-policy
6
0
Fork 0
Code Issues Pull Requests Releases Activity

Sendmail patch from Dan Walsh.

Browse Source
This commit is contained in:
Chris PeBenito 2010-05-20 08:36:38 -04:00
parent b276e36914
commit 9ea85eaa8b
2 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
policy/modules/services/sendmail.if
View File

@ -251,6 +251,24 @@ interface(`sendmail_manage_tmp_files',`
manage_files_pattern($1, sendmail_tmp_t, sendmail_tmp_t) manage_files_pattern($1, sendmail_tmp_t, sendmail_tmp_t)
') ')
########################################
## <summary>
## Execute sendmail in the unconfined sendmail domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`sendmail_domtrans_unconfined',`
gen_require(`
type unconfined_sendmail_t;
')
mta_sendmail_domtrans($1, unconfined_sendmail_t)
')
######################################## ########################################
## <summary> ## <summary>
## Execute sendmail in the unconfined sendmail domain, and ## Execute sendmail in the unconfined sendmail domain, and

6
policy/modules/services/sendmail.te
View File

@ -1,5 +1,5 @@
policy_module(sendmail, 1.10.1) policy_module(sendmail, 1.10.2)
######################################## ########################################
# #
@ -30,7 +30,7 @@ role system_r types unconfined_sendmail_t;
# #
allow sendmail_t self:capability { dac_override setuid setgid net_bind_service sys_nice chown sys_tty_config }; allow sendmail_t self:capability { dac_override setuid setgid net_bind_service sys_nice chown sys_tty_config };
allow sendmail_t self:process { setrlimit signal signull }; allow sendmail_t self:process { setsched setpgid setrlimit signal signull };
allow sendmail_t self:fifo_file rw_fifo_file_perms; allow sendmail_t self:fifo_file rw_fifo_file_perms;
allow sendmail_t self:unix_stream_socket create_stream_socket_perms; allow sendmail_t self:unix_stream_socket create_stream_socket_perms;
allow sendmail_t self:unix_dgram_socket create_socket_perms; allow sendmail_t self:unix_dgram_socket create_socket_perms;
@ -72,6 +72,7 @@ fs_search_auto_mountpoints(sendmail_t)
fs_rw_anon_inodefs_files(sendmail_t) fs_rw_anon_inodefs_files(sendmail_t)
term_dontaudit_use_console(sendmail_t) term_dontaudit_use_console(sendmail_t)
term_dontaudit_use_generic_ptys(sendmail_t)
# for piping mail to a command # for piping mail to a command
corecmd_exec_shell(sendmail_t) corecmd_exec_shell(sendmail_t)
@ -133,6 +134,7 @@ optional_policy(`
optional_policy(` optional_policy(`
fail2ban_read_lib_files(sendmail_t) fail2ban_read_lib_files(sendmail_t)
fail2ban_rw_stream_sockets(sendmail_t)
') ')
optional_policy(` optional_policy(`