policy/modules/services/amavis.te

   1 policy_module(amavis, 1.11.1)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type amavis_t;
   9 type amavis_exec_t;
  10 domain_type(amavis_t)
  11 init_daemon_domain(amavis_t, amavis_exec_t)
  12
  13 # configuration files
  14 type amavis_etc_t;
  15 files_config_file(amavis_etc_t)
  16
  17 type amavis_initrc_exec_t;
  18 init_script_file(amavis_initrc_exec_t)
  19
  20 # pid files
  21 type amavis_var_run_t;
  22 files_pid_file(amavis_var_run_t)
  23
  24 # var/lib files
  25 type amavis_var_lib_t;
  26 files_type(amavis_var_lib_t)
  27
  28 # log files
  29 type amavis_var_log_t;
  30 logging_log_file(amavis_var_log_t)
  31
  32 # tmp files
  33 type amavis_tmp_t;
  34 files_tmp_file(amavis_tmp_t)
  35
  36 # virus quarantine
  37 type amavis_quarantine_t;
  38 files_type(amavis_quarantine_t)
  39
  40 type amavis_spool_t;
  41 files_spool_file(amavis_spool_t)
  42
  43 ########################################
  44 #
  45 # amavis local policy
  46 #
  47
  48 allow amavis_t self:capability { kill chown dac_override setgid setuid };
  49 dontaudit amavis_t self:capability sys_tty_config;
  50 allow amavis_t self:process { signal sigchld sigkill signull };
  51 allow amavis_t self:fifo_file rw_fifo_file_perms;
  52 allow amavis_t self:unix_stream_socket create_stream_socket_perms;
  53 allow amavis_t self:unix_dgram_socket create_socket_perms;
  54 allow amavis_t self:tcp_socket { listen accept };
  55 allow amavis_t self:netlink_route_socket r_netlink_socket_perms;
  56
  57 # configuration files
  58 allow amavis_t amavis_etc_t:dir list_dir_perms;
  59 read_files_pattern(amavis_t, amavis_etc_t, amavis_etc_t)
  60 read_lnk_files_pattern(amavis_t, amavis_etc_t, amavis_etc_t)
  61
  62 can_exec(amavis_t, amavis_exec_t)
  63
  64 # mail quarantine
  65 manage_dirs_pattern(amavis_t, amavis_quarantine_t, amavis_quarantine_t)
  66 manage_files_pattern(amavis_t, amavis_quarantine_t, amavis_quarantine_t)
  67 manage_sock_files_pattern(amavis_t, amavis_quarantine_t, amavis_quarantine_t)
  68
  69 # Spool Files
  70 manage_dirs_pattern(amavis_t, amavis_spool_t, amavis_spool_t)
  71 manage_files_pattern(amavis_t, amavis_spool_t, amavis_spool_t)
  72 manage_lnk_files_pattern(amavis_t, amavis_spool_t, amavis_spool_t)
  73 manage_sock_files_pattern(amavis_t, amavis_spool_t, amavis_spool_t)
  74 filetrans_pattern(amavis_t, amavis_spool_t, amavis_var_run_t, sock_file)
  75 files_search_spool(amavis_t)
  76
  77 # tmp files
  78 manage_files_pattern(amavis_t, amavis_tmp_t, amavis_tmp_t)
  79 allow amavis_t amavis_tmp_t:dir setattr_dir_perms;
  80 files_tmp_filetrans(amavis_t, amavis_tmp_t, file)
  81
  82 # var/lib files for amavis
  83 manage_dirs_pattern(amavis_t, amavis_var_lib_t, amavis_var_lib_t)
  84 manage_files_pattern(amavis_t, amavis_var_lib_t, amavis_var_lib_t)
  85 manage_sock_files_pattern(amavis_t, amavis_var_lib_t, amavis_var_lib_t)
  86 files_search_var_lib(amavis_t)
  87
  88 # log files
  89 allow amavis_t amavis_var_log_t:dir setattr_dir_perms;
  90 manage_files_pattern(amavis_t, amavis_var_log_t, amavis_var_log_t)
  91 manage_sock_files_pattern(amavis_t, amavis_var_log_t, amavis_var_log_t)
  92 logging_log_filetrans(amavis_t, amavis_var_log_t, { sock_file file dir })
  93
  94 # pid file
  95 manage_dirs_pattern(amavis_t, amavis_var_run_t, amavis_var_run_t)
  96 manage_files_pattern(amavis_t, amavis_var_run_t, amavis_var_run_t)
  97 manage_sock_files_pattern(amavis_t, amavis_var_run_t, amavis_var_run_t)
  98 files_pid_filetrans(amavis_t, amavis_var_run_t, { dir file sock_file })
  99
 100 kernel_read_kernel_sysctls(amavis_t)
 101 # amavis tries to access /proc/self/stat, /etc/shadow and /root - perl...
 102 kernel_dontaudit_list_proc(amavis_t)
 103 kernel_dontaudit_read_proc_symlinks(amavis_t)
 104 kernel_dontaudit_read_system_state(amavis_t)
 105
 106 # find perl
 107 corecmd_exec_bin(amavis_t)
 108 corecmd_exec_shell(amavis_t)
 109
 110 corenet_all_recvfrom_unlabeled(amavis_t)
 111 corenet_all_recvfrom_netlabel(amavis_t)
 112 corenet_tcp_sendrecv_generic_if(amavis_t)
 113 corenet_tcp_sendrecv_generic_node(amavis_t)
 114 corenet_tcp_bind_generic_node(amavis_t)
 115 corenet_udp_bind_generic_node(amavis_t)
 116 # amavis uses well-defined ports
 117 corenet_tcp_sendrecv_amavisd_recv_port(amavis_t)
 118 corenet_tcp_sendrecv_amavisd_send_port(amavis_t)
 119 # just the other side not. ;-)
 120 corenet_tcp_sendrecv_all_ports(amavis_t)
 121 # connect to backchannel port
 122 corenet_tcp_connect_amavisd_send_port(amavis_t)
 123 # bind to incoming port
 124 corenet_tcp_bind_amavisd_recv_port(amavis_t)
 125 corenet_udp_bind_generic_port(amavis_t)
 126 corenet_dontaudit_udp_bind_all_ports(amavis_t)
 127 corenet_tcp_connect_razor_port(amavis_t)
 128
 129 dev_read_rand(amavis_t)
 130 dev_read_urand(amavis_t)
 131 dev_read_sysfs(amavis_t)
 132
 133 domain_use_interactive_fds(amavis_t)
 134
 135 files_read_etc_files(amavis_t)
 136 files_read_etc_runtime_files(amavis_t)
 137 files_read_usr_files(amavis_t)
 138
 139 fs_getattr_xattr_fs(amavis_t)
 140
 141 auth_dontaudit_read_shadow(amavis_t)
 142
 143 # uses uptime which reads utmp - redhat bug 561383
 144 init_read_utmp(amavis_t)
 145 init_stream_connect_script(amavis_t)
 146
 147 logging_send_syslog_msg(amavis_t)
 148
 149 miscfiles_read_generic_certs(amavis_t)
 150 miscfiles_read_localization(amavis_t)
 151
 152 sysnet_dns_name_resolve(amavis_t)
 153 sysnet_use_ldap(amavis_t)
 154
 155 userdom_dontaudit_search_user_home_dirs(amavis_t)
 156
 157 optional_policy(`
 158         clamav_stream_connect(amavis_t)
 159         clamav_domtrans_clamscan(amavis_t)
 160 ')
 161
 162 optional_policy(`
 163         #Cron handling
 164         cron_use_fds(amavis_t)
 165         cron_use_system_job_fds(amavis_t)
 166         cron_rw_pipes(amavis_t)
 167 ')
 168
 169 optional_policy(`
 170         dcc_domtrans_client(amavis_t)
 171         dcc_stream_connect_dccifd(amavis_t)
 172 ')
 173
 174 optional_policy(`
 175         mta_read_config(amavis_t)
 176 ')
 177
 178 optional_policy(`
 179         nslcd_stream_connect(amavis_t)
 180 ')
 181
 182 optional_policy(`
 183         postfix_read_config(amavis_t)
 184 ')
 185
 186 optional_policy(`
 187         pyzor_domtrans(amavis_t)
 188         pyzor_signal(amavis_t)
 189 ')
 190
 191 optional_policy(`
 192         razor_domtrans(amavis_t)
 193 ')
 194
 195 optional_policy(`
 196         spamassassin_exec(amavis_t)
 197         spamassassin_exec_client(amavis_t)
 198         spamassassin_read_lib_files(amavis_t)
 199 ')