policy/modules/services/postfix.te

   1
   2 policy_module(postfix, 1.9.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 attribute postfix_user_domains;
  10 # domains that transition to the
  11 # postfix user domains
  12 attribute postfix_user_domtrans;
  13
  14 postfix_server_domain_template(bounce)
  15
  16 type postfix_spool_bounce_t;
  17 files_type(postfix_spool_bounce_t)
  18
  19 postfix_server_domain_template(cleanup)
  20
  21 type postfix_etc_t;
  22 files_type(postfix_etc_t)
  23
  24 type postfix_exec_t;
  25 application_executable_file(postfix_exec_t)
  26
  27 postfix_server_domain_template(local)
  28 mta_mailserver_delivery(postfix_local_t)
  29
  30 type postfix_local_tmp_t;
  31 files_tmp_file(postfix_local_tmp_t)
  32
  33 # Program for creating database files
  34 type postfix_map_t;
  35 type postfix_map_exec_t;
  36 application_domain(postfix_map_t, postfix_map_exec_t)
  37
  38 type postfix_map_tmp_t;
  39 files_tmp_file(postfix_map_tmp_t)
  40
  41 postfix_domain_template(master)
  42 typealias postfix_master_t alias postfix_t;
  43 # alias is a hack to make the disable trans bool
  44 # generation macro work
  45 mta_mailserver(postfix_t, postfix_master_exec_t)
  46
  47 postfix_server_domain_template(pickup)
  48
  49 postfix_server_domain_template(pipe)
  50
  51 postfix_user_domain_template(postdrop)
  52 mta_mailserver_user_agent(postfix_postdrop_t)
  53
  54 postfix_user_domain_template(postqueue)
  55
  56 type postfix_private_t;
  57 files_type(postfix_private_t)
  58
  59 type postfix_prng_t;
  60 files_type(postfix_prng_t)
  61
  62 postfix_server_domain_template(qmgr)
  63
  64 postfix_user_domain_template(showq)
  65
  66 postfix_server_domain_template(smtp)
  67 mta_mailserver_sender(postfix_smtp_t)
  68
  69 postfix_server_domain_template(smtpd)
  70
  71 type postfix_spool_t;
  72 files_type(postfix_spool_t)
  73
  74 type postfix_spool_maildrop_t;
  75 files_type(postfix_spool_maildrop_t)
  76
  77 type postfix_spool_flush_t;
  78 files_type(postfix_spool_flush_t)
  79
  80 type postfix_public_t;
  81 files_type(postfix_public_t)
  82
  83 type postfix_var_run_t;
  84 files_pid_file(postfix_var_run_t)
  85
  86 # the data_directory config parameter
  87 type postfix_data_t;
  88 files_type(postfix_data_t)
  89
  90 postfix_server_domain_template(virtual)
  91 mta_mailserver_delivery(postfix_virtual_t)
  92
  93 type postfix_virtual_tmp_t;
  94 files_tmp_file(postfix_virtual_tmp_t)
  95
  96 ########################################
  97 #
  98 # Postfix master process local policy
  99 #
 100
 101 # chown is to set the correct ownership of queue dirs
 102 allow postfix_master_t self:capability { chown dac_override kill setgid setuid net_bind_service sys_tty_config };
 103 allow postfix_master_t self:fifo_file rw_fifo_file_perms;
 104 allow postfix_master_t self:tcp_socket create_stream_socket_perms;
 105 allow postfix_master_t self:udp_socket create_socket_perms;
 106
 107 allow postfix_master_t postfix_etc_t:file rw_file_perms;
 108
 109 can_exec(postfix_master_t,postfix_exec_t)
 110
 111 allow postfix_master_t postfix_data_t:dir manage_dir_perms;
 112 allow postfix_master_t postfix_data_t:file manage_file_perms;
 113
 114 allow postfix_master_t postfix_map_exec_t:file { mmap_file_perms ioctl lock };
 115
 116 allow postfix_master_t postfix_postdrop_exec_t:file getattr;
 117
 118 allow postfix_master_t postfix_postqueue_exec_t:file getattr;
 119
 120 manage_fifo_files_pattern(postfix_master_t, postfix_private_t, postfix_private_t)
 121 manage_sock_files_pattern(postfix_master_t, postfix_private_t, postfix_private_t)
 122
 123 domtrans_pattern(postfix_master_t, postfix_postqueue_exec_t, postfix_postqueue_t)
 124
 125 allow postfix_master_t postfix_prng_t:file rw_file_perms;
 126
 127 manage_fifo_files_pattern(postfix_master_t, postfix_public_t, postfix_public_t)
 128 manage_sock_files_pattern(postfix_master_t, postfix_public_t, postfix_public_t)
 129
 130 domtrans_pattern(postfix_master_t, postfix_showq_exec_t, postfix_showq_t)
 131
 132 # allow access to deferred queue and allow removing bogus incoming entries
 133 manage_dirs_pattern(postfix_master_t, postfix_spool_t, postfix_spool_t)
 134 manage_files_pattern(postfix_master_t, postfix_spool_t, postfix_spool_t)
 135
 136 allow postfix_master_t postfix_spool_bounce_t:dir manage_dir_perms;
 137 allow postfix_master_t postfix_spool_bounce_t:file getattr;
 138
 139 manage_dirs_pattern(postfix_master_t, postfix_spool_flush_t, postfix_spool_flush_t)
 140 manage_files_pattern(postfix_master_t, postfix_spool_flush_t, postfix_spool_flush_t)
 141 manage_lnk_files_pattern(postfix_master_t, postfix_spool_flush_t, postfix_spool_flush_t)
 142
 143 delete_files_pattern(postfix_master_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
 144 rename_files_pattern(postfix_master_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
 145
 146 kernel_read_all_sysctls(postfix_master_t)
 147
 148 corenet_all_recvfrom_unlabeled(postfix_master_t)
 149 corenet_all_recvfrom_netlabel(postfix_master_t)
 150 corenet_tcp_sendrecv_all_if(postfix_master_t)
 151 corenet_udp_sendrecv_all_if(postfix_master_t)
 152 corenet_tcp_sendrecv_all_nodes(postfix_master_t)
 153 corenet_udp_sendrecv_all_nodes(postfix_master_t)
 154 corenet_tcp_sendrecv_all_ports(postfix_master_t)
 155 corenet_udp_sendrecv_all_ports(postfix_master_t)
 156 corenet_tcp_bind_all_nodes(postfix_master_t)
 157 corenet_tcp_bind_amavisd_send_port(postfix_master_t)
 158 corenet_tcp_bind_smtp_port(postfix_master_t)
 159 corenet_tcp_connect_all_ports(postfix_master_t)
 160 corenet_sendrecv_amavisd_send_server_packets(postfix_master_t)
 161 corenet_sendrecv_smtp_server_packets(postfix_master_t)
 162 corenet_sendrecv_all_client_packets(postfix_master_t)
 163
 164 # for a find command
 165 selinux_dontaudit_search_fs(postfix_master_t)
 166
 167 corecmd_exec_shell(postfix_master_t)
 168 corecmd_exec_bin(postfix_master_t)
 169
 170 domain_use_interactive_fds(postfix_master_t)
 171
 172 files_read_usr_files(postfix_master_t)
 173
 174 term_dontaudit_search_ptys(postfix_master_t)
 175
 176 miscfiles_read_man_pages(postfix_master_t)
 177
 178 seutil_sigchld_newrole(postfix_master_t)
 179 # postfix does a "find" on startup for some reason - keep it quiet
 180 seutil_dontaudit_search_config(postfix_master_t)
 181
 182 mta_rw_aliases(postfix_master_t)
 183 mta_read_sendmail_bin(postfix_master_t)
 184
 185 ifdef(`distro_redhat',`
 186         # for newer main.cf that uses /etc/aliases
 187         mta_manage_aliases(postfix_master_t)
 188         mta_etc_filetrans_aliases(postfix_master_t)
 189 ')
 190
 191 optional_policy(`
 192         cyrus_stream_connect(postfix_master_t)
 193 ')
 194
 195 optional_policy(`
 196 #       for postalias
 197         mailman_manage_data_files(postfix_master_t)
 198 ')
 199
 200 optional_policy(`
 201         mysql_stream_connect(postfix_master_t)
 202 ')
 203
 204 optional_policy(`
 205         sendmail_signal(postfix_master_t)
 206 ')
 207
 208 ########################################
 209 #
 210 # Postfix bounce local policy
 211 #
 212
 213 allow postfix_bounce_t self:capability dac_read_search;
 214 allow postfix_bounce_t self:tcp_socket create_socket_perms;
 215
 216 allow postfix_bounce_t postfix_public_t:sock_file write;
 217 allow postfix_bounce_t postfix_public_t:dir search;
 218
 219 manage_dirs_pattern(postfix_bounce_t, postfix_spool_t, postfix_spool_t)
 220 manage_files_pattern(postfix_bounce_t, postfix_spool_t, postfix_spool_t)
 221 manage_lnk_files_pattern(postfix_bounce_t, postfix_spool_t, postfix_spool_t)
 222
 223 manage_dirs_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool_bounce_t)
 224 manage_files_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool_bounce_t)
 225 manage_lnk_files_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool_bounce_t)
 226
 227 ########################################
 228 #
 229 # Postfix cleanup local policy
 230 #
 231
 232 allow postfix_cleanup_t self:process setrlimit;
 233
 234 # connect to master process
 235 stream_connect_pattern(postfix_cleanup_t, postfix_private_t, postfix_private_t, postfix_master_t)
 236
 237 rw_fifo_files_pattern(postfix_cleanup_t, postfix_public_t, postfix_public_t)
 238 write_sock_files_pattern(postfix_cleanup_t, postfix_public_t, postfix_public_t)
 239
 240 manage_dirs_pattern(postfix_cleanup_t, postfix_spool_t, postfix_spool_t)
 241 manage_files_pattern(postfix_cleanup_t, postfix_spool_t, postfix_spool_t)
 242 manage_lnk_files_pattern(postfix_cleanup_t, postfix_spool_t, postfix_spool_t)
 243
 244 allow postfix_cleanup_t postfix_spool_bounce_t:dir list_dir_perms;
 245
 246 corecmd_exec_bin(postfix_cleanup_t)
 247
 248 ########################################
 249 #
 250 # Postfix local local policy
 251 #
 252
 253 allow postfix_local_t self:fifo_file rw_fifo_file_perms;
 254 allow postfix_local_t self:process { setsched setrlimit };
 255
 256 manage_dirs_pattern(postfix_local_t, postfix_local_tmp_t, postfix_local_tmp_t)
 257 manage_files_pattern(postfix_local_t, postfix_local_tmp_t, postfix_local_tmp_t)
 258 files_tmp_filetrans(postfix_local_t, postfix_local_tmp_t, { file dir })
 259
 260 # connect to master process
 261 stream_connect_pattern(postfix_local_t, postfix_public_t, postfix_public_t, postfix_master_t)
 262
 263 # for .forward - maybe we need a new type for it?
 264 rw_sock_files_pattern(postfix_local_t, postfix_private_t, postfix_private_t)
 265
 266 allow postfix_local_t postfix_spool_t:file rw_file_perms;
 267
 268 corecmd_exec_shell(postfix_local_t)
 269 corecmd_exec_bin(postfix_local_t)
 270
 271 files_read_etc_files(postfix_local_t)
 272
 273 mta_read_aliases(postfix_local_t)
 274 mta_delete_spool(postfix_local_t)
 275 # For reading spamassasin
 276 mta_read_config(postfix_local_t)
 277
 278 optional_policy(`
 279         clamav_search_lib(postfix_local_t)
 280 ')
 281
 282 optional_policy(`
 283 #       for postalias
 284         mailman_manage_data_files(postfix_local_t)
 285 ')
 286
 287 optional_policy(`
 288         procmail_domtrans(postfix_local_t)
 289 ')
 290
 291 ########################################
 292 #
 293 # Postfix map local policy
 294 #
 295
 296 allow postfix_map_t self:capability setgid;
 297 allow postfix_map_t self:unix_stream_socket create_stream_socket_perms;
 298 allow postfix_map_t self:unix_dgram_socket create_socket_perms;
 299 allow postfix_map_t self:tcp_socket create_stream_socket_perms;
 300 allow postfix_map_t self:udp_socket create_socket_perms;
 301
 302 manage_dirs_pattern(postfix_map_t, postfix_etc_t, postfix_etc_t)
 303 manage_files_pattern(postfix_map_t, postfix_etc_t, postfix_etc_t)
 304 manage_lnk_files_pattern(postfix_map_t, postfix_etc_t, postfix_etc_t)
 305
 306 manage_dirs_pattern(postfix_map_t, postfix_map_tmp_t, postfix_map_tmp_t)
 307 manage_files_pattern(postfix_map_t, postfix_map_tmp_t, postfix_map_tmp_t)
 308 files_tmp_filetrans(postfix_map_t, postfix_map_tmp_t, { file dir })
 309
 310 kernel_read_kernel_sysctls(postfix_map_t)
 311 kernel_dontaudit_list_proc(postfix_map_t)
 312 kernel_dontaudit_read_system_state(postfix_map_t)
 313
 314 corenet_all_recvfrom_unlabeled(postfix_map_t)
 315 corenet_all_recvfrom_netlabel(postfix_map_t)
 316 corenet_tcp_sendrecv_all_if(postfix_map_t)
 317 corenet_udp_sendrecv_all_if(postfix_map_t)
 318 corenet_tcp_sendrecv_all_nodes(postfix_map_t)
 319 corenet_udp_sendrecv_all_nodes(postfix_map_t)
 320 corenet_tcp_sendrecv_all_ports(postfix_map_t)
 321 corenet_udp_sendrecv_all_ports(postfix_map_t)
 322 corenet_tcp_connect_all_ports(postfix_map_t)
 323 corenet_sendrecv_all_client_packets(postfix_map_t)
 324
 325 corecmd_list_bin(postfix_map_t)
 326 corecmd_read_bin_symlinks(postfix_map_t)
 327 corecmd_read_bin_files(postfix_map_t)
 328 corecmd_read_bin_pipes(postfix_map_t)
 329 corecmd_read_bin_sockets(postfix_map_t)
 330
 331 files_list_home(postfix_map_t)
 332 files_read_usr_files(postfix_map_t)
 333 files_read_etc_files(postfix_map_t)
 334 files_read_etc_runtime_files(postfix_map_t)
 335 files_dontaudit_search_var(postfix_map_t)
 336
 337 auth_use_nsswitch(postfix_map_t)
 338
 339 libs_use_ld_so(postfix_map_t)
 340 libs_use_shared_libs(postfix_map_t)
 341
 342 logging_send_syslog_msg(postfix_map_t)
 343
 344 miscfiles_read_localization(postfix_map_t)
 345
 346 seutil_read_config(postfix_map_t)
 347
 348 tunable_policy(`read_default_t',`
 349         files_list_default(postfix_map_t)
 350         files_read_default_files(postfix_map_t)
 351         files_read_default_symlinks(postfix_map_t)
 352         files_read_default_sockets(postfix_map_t)
 353         files_read_default_pipes(postfix_map_t)
 354 ')
 355
 356 optional_policy(`
 357         locallogin_dontaudit_use_fds(postfix_map_t)
 358 ')
 359
 360 ########################################
 361 #
 362 # Postfix pickup local policy
 363 #
 364
 365 allow postfix_pickup_t self:tcp_socket create_socket_perms;
 366
 367 stream_connect_pattern(postfix_pickup_t,postfix_private_t,postfix_private_t,postfix_master_t)
 368
 369 rw_fifo_files_pattern(postfix_pickup_t, postfix_public_t, postfix_public_t)
 370 rw_sock_files_pattern(postfix_pickup_t, postfix_public_t, postfix_public_t)
 371
 372 postfix_list_spool(postfix_pickup_t)
 373
 374 allow postfix_pickup_t postfix_spool_maildrop_t:dir list_dir_perms;
 375 read_files_pattern(postfix_pickup_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
 376 delete_files_pattern(postfix_pickup_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
 377
 378 ########################################
 379 #
 380 # Postfix pipe local policy
 381 #
 382
 383 allow postfix_pipe_t self:fifo_file rw_fifo_file_perms;
 384
 385 write_sock_files_pattern(postfix_pipe_t, postfix_private_t, postfix_private_t)
 386
 387 write_fifo_files_pattern(postfix_pipe_t, postfix_public_t, postfix_public_t)
 388
 389 rw_files_pattern(postfix_pipe_t, postfix_spool_t, postfix_spool_t)
 390
 391 optional_policy(`
 392         procmail_domtrans(postfix_pipe_t)
 393 ')
 394
 395 optional_policy(`
 396         mailman_domtrans_queue(postfix_pipe_t)
 397 ')
 398
 399 optional_policy(`
 400         uucp_domtrans_uux(postfix_pipe_t)
 401 ')
 402
 403 ########################################
 404 #
 405 # Postfix postdrop local policy
 406 #
 407
 408 # usually it does not need a UDP socket
 409 allow postfix_postdrop_t self:capability sys_resource;
 410 allow postfix_postdrop_t self:tcp_socket create;
 411 allow postfix_postdrop_t self:udp_socket create_socket_perms;
 412
 413 rw_fifo_files_pattern(postfix_postdrop_t, postfix_public_t, postfix_public_t)
 414
 415 postfix_list_spool(postfix_postdrop_t)
 416 manage_files_pattern(postfix_postdrop_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
 417
 418 corenet_udp_sendrecv_all_if(postfix_postdrop_t)
 419 corenet_udp_sendrecv_all_nodes(postfix_postdrop_t)
 420
 421 term_dontaudit_use_all_user_ptys(postfix_postdrop_t)
 422 term_dontaudit_use_all_user_ttys(postfix_postdrop_t)
 423
 424 mta_rw_user_mail_stream_sockets(postfix_postdrop_t)
 425
 426 optional_policy(`
 427         cron_system_entry(postfix_postdrop_t, postfix_postdrop_exec_t)
 428 ')
 429
 430 # https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239951
 431 optional_policy(`
 432         fstools_read_pipes(postfix_postdrop_t)
 433 ')
 434
 435 optional_policy(`
 436         ppp_use_fds(postfix_postqueue_t)
 437         ppp_sigchld(postfix_postqueue_t)
 438 ')
 439
 440 #######################################
 441 #
 442 # Postfix postqueue local policy
 443 #
 444
 445 allow postfix_postqueue_t self:tcp_socket create;
 446 allow postfix_postqueue_t self:udp_socket { create ioctl };
 447
 448 # wants to write to /var/spool/postfix/public/showq
 449 stream_connect_pattern(postfix_postqueue_t, postfix_public_t, postfix_public_t,postfix_master_t)
 450
 451 # write to /var/spool/postfix/public/qmgr
 452 write_fifo_files_pattern(postfix_postqueue_t, postfix_public_t, postfix_public_t)
 453
 454 domtrans_pattern(postfix_postqueue_t, postfix_showq_exec_t, postfix_showq_t)
 455
 456 # to write the mailq output, it really should not need read access!
 457 term_use_all_user_ptys(postfix_postqueue_t)
 458 term_use_all_user_ttys(postfix_postqueue_t)
 459
 460 init_sigchld_script(postfix_postqueue_t)
 461 init_use_script_fds(postfix_postqueue_t)
 462
 463 ########################################
 464 #
 465 # Postfix qmgr local policy
 466 #
 467
 468 stream_connect_pattern(postfix_qmgr_t, { postfix_private_t postfix_public_t }, { postfix_private_t postfix_public_t },postfix_master_t)
 469
 470 rw_fifo_files_pattern(postfix_qmgr_t, postfix_public_t, postfix_public_t)
 471
 472 # for /var/spool/postfix/active
 473 manage_dirs_pattern(postfix_qmgr_t, postfix_spool_t, postfix_spool_t)
 474 manage_files_pattern(postfix_qmgr_t, postfix_spool_t, postfix_spool_t)
 475 manage_lnk_files_pattern(postfix_qmgr_t, postfix_spool_t, postfix_spool_t)
 476
 477 allow postfix_qmgr_t postfix_spool_bounce_t:dir list_dir_perms;
 478 allow postfix_qmgr_t postfix_spool_bounce_t:file read_file_perms;
 479 allow postfix_qmgr_t postfix_spool_bounce_t:lnk_file { getattr read };
 480
 481 corecmd_exec_bin(postfix_qmgr_t)
 482
 483 ########################################
 484 #
 485 # Postfix showq local policy
 486 #
 487
 488 allow postfix_showq_t self:capability { setuid setgid };
 489 allow postfix_showq_t self:tcp_socket create_socket_perms;
 490
 491 allow postfix_showq_t postfix_master_t:unix_stream_socket { accept rw_socket_perms };
 492
 493 allow postfix_showq_t postfix_spool_t:file read_file_perms;
 494
 495 postfix_list_spool(postfix_showq_t)
 496
 497 allow postfix_showq_t postfix_spool_maildrop_t:dir list_dir_perms;
 498 allow postfix_showq_t postfix_spool_maildrop_t:file read_file_perms;
 499 allow postfix_showq_t postfix_spool_maildrop_t:lnk_file { getattr read };
 500
 501 # to write the mailq output, it really should not need read access!
 502 term_use_all_user_ptys(postfix_showq_t)
 503 term_use_all_user_ttys(postfix_showq_t)
 504
 505 ########################################
 506 #
 507 # Postfix smtp delivery local policy
 508 #
 509
 510 # connect to master process
 511 stream_connect_pattern(postfix_smtp_t, { postfix_private_t postfix_public_t }, { postfix_private_t postfix_public_t },postfix_master_t)
 512
 513 allow postfix_smtp_t postfix_prng_t:file rw_file_perms;
 514
 515 allow postfix_smtp_t postfix_spool_t:file rw_file_perms;
 516
 517 files_dontaudit_getattr_home_dir(postfix_smtp_t)
 518
 519 optional_policy(`
 520         cyrus_stream_connect(postfix_smtp_t)
 521 ')
 522
 523 ########################################
 524 #
 525 # Postfix smtpd local policy
 526 #
 527 allow postfix_smtpd_t postfix_master_t:tcp_socket rw_stream_socket_perms;
 528
 529 # connect to master process
 530 stream_connect_pattern(postfix_smtpd_t, { postfix_private_t postfix_public_t }, { postfix_private_t postfix_public_t },postfix_master_t)
 531
 532 # Connect to policy server
 533 corenet_tcp_connect_postfix_policyd_port(postfix_smtpd_t)
 534
 535 # for prng_exch
 536 allow postfix_smtpd_t postfix_spool_t:file rw_file_perms;
 537 allow postfix_smtpd_t postfix_prng_t:file rw_file_perms;
 538
 539 corecmd_exec_bin(postfix_smtpd_t)
 540
 541 # for OpenSSL certificates
 542 files_read_usr_files(postfix_smtpd_t)
 543 mta_read_aliases(postfix_smtpd_t)
 544
 545 optional_policy(`
 546         mailman_read_data_files(postfix_smtpd_t)
 547 ')
 548
 549 optional_policy(`
 550         postgrey_stream_connect(postfix_smtpd_t)
 551 ')
 552
 553 optional_policy(`
 554         sasl_connect(postfix_smtpd_t)
 555 ')
 556
 557 ########################################
 558 #
 559 # Postfix virtual local policy
 560 #
 561
 562 allow postfix_virtual_t self:fifo_file rw_fifo_file_perms;
 563 allow postfix_virtual_t self:process { setsched setrlimit };
 564
 565 allow postfix_virtual_t postfix_spool_t:file rw_file_perms;
 566
 567 manage_dirs_pattern(postfix_virtual_t, postfix_virtual_tmp_t, postfix_virtual_tmp_t)
 568 manage_files_pattern(postfix_virtual_t, postfix_virtual_tmp_t, postfix_virtual_tmp_t)
 569 files_tmp_filetrans(postfix_virtual_t, postfix_virtual_tmp_t, { file dir })
 570
 571 # connect to master process
 572 stream_connect_pattern(postfix_virtual_t, postfix_public_t, postfix_public_t, postfix_master_t)
 573
 574 corecmd_exec_shell(postfix_virtual_t)
 575 corecmd_exec_bin(postfix_virtual_t)
 576
 577 files_read_etc_files(postfix_virtual_t)
 578
 579 mta_read_aliases(postfix_virtual_t)
 580 mta_delete_spool(postfix_virtual_t)
 581 # For reading spamassasin
 582 mta_read_config(postfix_virtual_t)
 583 mta_manage_spool(postfix_virtual_t)