policy/modules/services/milter.te

   1 policy_module(milter, 1.2.1)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 # attributes common to all milters
   9 attribute milter_domains;
  10 attribute milter_data_type;
  11
  12 # support for dkim-milter - domainKeys Identified Mail sender authentication sendmail milter
  13 milter_template(dkim)
  14
  15 # type for the private key of dkim-milter
  16 type dkim_milter_private_key_t;
  17 files_type(dkim_milter_private_key_t)
  18
  19 # currently-supported milters are milter-greylist, milter-regex and spamass-milter
  20 milter_template(greylist)
  21 milter_template(regex)
  22 milter_template(spamass)
  23
  24 # Type for the spamass-milter home directory, under which spamassassin will
  25 # store system-wide preferences, bayes databases etc. if not configured to
  26 # use per-user configuration
  27 type spamass_milter_state_t;
  28 files_type(spamass_milter_state_t)
  29
  30 #######################################
  31 #
  32 # dkim-milter local policy
  33 #
  34
  35 allow dkim_milter_t self:capability { kill setgid setuid };
  36
  37 allow dkim_milter_t self:unix_stream_socket create_stream_socket_perms;
  38
  39 read_files_pattern(dkim_milter_t, dkim_milter_private_key_t, dkim_milter_private_key_t)
  40
  41 auth_use_nsswitch(dkim_milter_t)
  42
  43 sysnet_dns_name_resolve(dkim_milter_t)
  44
  45 mta_read_config(dkim_milter_t)
  46
  47 ########################################
  48 #
  49 # milter-greylist local policy
  50 #   ensure smtp clients retry mail like real MTAs and not spamware
  51 #   http://hcpnet.free.fr/milter-greylist/
  52 #
  53
  54 # It removes any existing socket (not owned by root) whilst running as root,
  55 # fixes permissions, renices itself and then calls setgid() and setuid() to
  56 # drop privileges
  57 allow greylist_milter_t self:capability { chown dac_override setgid setuid sys_nice };
  58 allow greylist_milter_t self:process { setsched getsched };
  59
  60 # It creates a pid file /var/run/milter-greylist.pid
  61 files_pid_filetrans(greylist_milter_t, greylist_milter_data_t, file)
  62
  63 kernel_read_kernel_sysctls(greylist_milter_t)
  64
  65 # Allow the milter to read a GeoIP database in /usr/share
  66 files_read_usr_files(greylist_milter_t)
  67 # The milter runs from /var/lib/milter-greylist and maintains files there
  68 files_search_var_lib(greylist_milter_t)
  69
  70 # Look up username for dropping privs
  71 auth_use_nsswitch(greylist_milter_t)
  72
  73 # Config is in /etc/mail/greylist.conf
  74 mta_read_config(greylist_milter_t)
  75
  76 ########################################
  77 #
  78 # milter-regex local policy
  79 #   filter emails using regular expressions
  80 #   http://www.benzedrine.cx/milter-regex.html
  81 #
  82
  83 # It removes any existing socket (not owned by root) whilst running as root
  84 # and then calls setgid() and setuid() to drop privileges
  85 allow regex_milter_t self:capability { setuid setgid dac_override };
  86
  87 # The milter's socket directory lives under /var/spool
  88 files_search_spool(regex_milter_t)
  89
  90 # Look up username for dropping privs
  91 auth_use_nsswitch(regex_milter_t)
  92
  93 # Config is in /etc/mail/milter-regex.conf
  94 mta_read_config(regex_milter_t)
  95
  96 ########################################
  97 #
  98 # spamass-milter local policy
  99 #   pipe emails through SpamAssassin
 100 #   http://savannah.nongnu.org/projects/spamass-milt/
 101 #
 102
 103 # The milter runs from /var/lib/spamass-milter
 104 allow spamass_milter_t spamass_milter_state_t:dir search_dir_perms;
 105 files_search_var_lib(spamass_milter_t)
 106
 107 kernel_read_system_state(spamass_milter_t)
 108
 109 # When used with -b or -B options, the milter invokes sendmail to send mail
 110 # to a spamtrap address, using popen()
 111 corecmd_exec_shell(spamass_milter_t)
 112 corecmd_read_bin_symlinks(spamass_milter_t)
 113 corecmd_search_bin(spamass_milter_t)
 114
 115 mta_send_mail(spamass_milter_t)
 116
 117 # The main job of the milter is to pipe spam through spamc and act on the result
 118 optional_policy(`
 119         spamassassin_domtrans_client(spamass_milter_t)
 120 ')