policy/modules/services/mta.if

   1 ## <summary>Policy common to all email tranfer agents.</summary>
   2
   3 ########################################
   4 ## <summary>
   5 ##      MTA stub interface.  No access allowed.
   6 ## </summary>
   7 ## <param name="domain" optional="true">
   8 ##      <summary>
   9 ##      N/A
  10 ##      </summary>
  11 ## </param>
  12 #
  13 interface(`mta_stub',`
  14         gen_require(`
  15                 type sendmail_exec_t;
  16         ')
  17 ')
  18
  19 #######################################
  20 ## <summary>
  21 ##      Basic mail transfer agent domain template.
  22 ## </summary>
  23 ## <desc>
  24 ##      <p>
  25 ##      This template creates a derived domain which is
  26 ##      a email transfer agent, which sends mail on
  27 ##      behalf of the user.
  28 ##      </p>
  29 ##      <p>
  30 ##      This is the basic types and rules, common
  31 ##      to the system agent and user agents.
  32 ##      </p>
  33 ## </desc>
  34 ## <param name="domain_prefix">
  35 ##      <summary>
  36 ##      The prefix of the domain (e.g., user
  37 ##      is the prefix for user_t).
  38 ##      </summary>
  39 ## </param>
  40 #
  41 template(`mta_base_mail_template',`
  42
  43         ##############################
  44         #
  45         # $1_mail_t declarations
  46         #
  47
  48         type $1_mail_t, user_mail_domain;
  49         domain_type($1_mail_t)
  50         domain_entry_file($1_mail_t,sendmail_exec_t)
  51
  52         type $1_mail_tmp_t;
  53         files_tmp_file($1_mail_tmp_t)
  54
  55         ##############################
  56         #
  57         # $1_mail_t local policy
  58         #
  59
  60         allow $1_mail_t self:capability { setuid setgid chown };
  61         allow $1_mail_t self:process { signal_perms setrlimit };
  62         allow $1_mail_t self:tcp_socket create_socket_perms;
  63
  64         # re-exec itself
  65         can_exec($1_mail_t, sendmail_exec_t)
  66         allow $1_mail_t sendmail_exec_t:lnk_file read_lnk_file_perms;
  67
  68         kernel_read_kernel_sysctls($1_mail_t)
  69
  70         corenet_non_ipsec_sendrecv($1_mail_t)
  71         corenet_tcp_sendrecv_all_if($1_mail_t)
  72         corenet_tcp_sendrecv_all_nodes($1_mail_t)
  73         corenet_tcp_sendrecv_all_ports($1_mail_t)
  74         corenet_tcp_connect_all_ports($1_mail_t)
  75         corenet_tcp_connect_smtp_port($1_mail_t)
  76         corenet_sendrecv_smtp_client_packets($1_mail_t)
  77
  78         corecmd_exec_bin($1_mail_t)
  79         corecmd_search_sbin($1_mail_t)
  80
  81         files_read_etc_files($1_mail_t)
  82         files_search_spool($1_mail_t)
  83         # It wants to check for nscd
  84         files_dontaudit_search_pids($1_mail_t)
  85
  86         libs_use_ld_so($1_mail_t)
  87         libs_use_shared_libs($1_mail_t)
  88
  89         logging_send_syslog_msg($1_mail_t)
  90
  91         miscfiles_read_localization($1_mail_t)
  92
  93         sysnet_read_config($1_mail_t)
  94         sysnet_dns_name_resolve($1_mail_t)
  95
  96         optional_policy(`
  97                 nis_use_ypbind($1_mail_t)
  98         ')
  99
 100         optional_policy(`
 101                 nscd_socket_use($1_mail_t)
 102         ')
 103
 104         optional_policy(`
 105                 postfix_domtrans_user_mail_handler($1_mail_t)
 106         ')
 107
 108         optional_policy(`
 109                 procmail_exec($1_mail_t)
 110         ')
 111
 112         optional_policy(`
 113                 qmail_domtrans_inject($1_mail_t)
 114         ')
 115
 116         optional_policy(`
 117                 gen_require(`
 118                         type etc_mail_t, mail_spool_t, mqueue_spool_t;
 119                 ')
 120
 121                 manage_dirs_pattern($1_mail_t,$1_mail_tmp_t,$1_mail_tmp_t)
 122                 manage_files_pattern($1_mail_t,$1_mail_tmp_t,$1_mail_tmp_t)
 123                 files_tmp_filetrans($1_mail_t, $1_mail_tmp_t, { file dir })
 124
 125                 allow $1_mail_t etc_mail_t:dir { getattr search };
 126
 127                 # Write to /var/spool/mail and /var/spool/mqueue.
 128                 manage_files_pattern($1_mail_t,mail_spool_t,mail_spool_t)
 129                 manage_files_pattern($1_mail_t,mqueue_spool_t,mqueue_spool_t)
 130
 131                 # Check available space.
 132                 fs_getattr_xattr_fs($1_mail_t)
 133
 134                 files_read_etc_runtime_files($1_mail_t)
 135
 136                 # Write to /var/log/sendmail.st
 137                 sendmail_manage_log($1_mail_t)
 138                 sendmail_create_log($1_mail_t)
 139         ')
 140
 141 ')
 142
 143 #######################################
 144 ## <summary>
 145 ##      The per role template for the mta module.
 146 ## </summary>
 147 ## <desc>
 148 ##      <p>
 149 ##      This template creates a derived domain which is
 150 ##      a email transfer agent, which sends mail on
 151 ##      behalf of the user.
 152 ##      </p>
 153 ##      <p>
 154 ##      This template is invoked automatically for each user, and
 155 ##      generally does not need to be invoked directly
 156 ##      by policy writers.
 157 ##      </p>
 158 ## </desc>
 159 ## <param name="userdomain_prefix">
 160 ##      <summary>
 161 ##      The prefix of the user domain (e.g., user
 162 ##      is the prefix for user_t).
 163 ##      </summary>
 164 ## </param>
 165 ## <param name="user_domain">
 166 ##      <summary>
 167 ##      The type of the user domain.
 168 ##      </summary>
 169 ## </param>
 170 ## <param name="user_role">
 171 ##      <summary>
 172 ##      The role associated with the user domain.
 173 ##      </summary>
 174 ## </param>
 175 #
 176 template(`mta_per_role_template',`
 177
 178         ##############################
 179         #
 180         # Declarations
 181         #
 182
 183         mta_base_mail_template($1)
 184         role $3 types $1_mail_t;
 185
 186         ##############################
 187         #
 188         # $1_mail_t local policy
 189         #
 190
 191         # Transition from the user domain to the derived domain.
 192         domtrans_pattern($2, sendmail_exec_t, $1_mail_t)
 193         allow $2 sendmail_exec_t:lnk_file { getattr read };
 194
 195         domain_use_interactive_fds($1_mail_t)
 196
 197         userdom_use_user_terminals($1,$1_mail_t)
 198         # Write to the user domain tty. cjp: why?
 199         userdom_use_user_terminals($1,mta_user_agent)
 200         # Create dead.letter in user home directories.
 201         userdom_manage_user_home_content_files($1,$1_mail_t)
 202         userdom_user_home_dir_filetrans_user_home_content($1,$1_mail_t,file)
 203         # for reading .forward - maybe we need a new type for it?
 204         # also for delivering mail to maildir
 205         userdom_manage_user_home_content_dirs($1,mailserver_delivery)
 206         userdom_manage_user_home_content_files($1,mailserver_delivery)
 207         userdom_manage_user_home_content_symlinks($1,mailserver_delivery)
 208         userdom_manage_user_home_content_pipes($1,mailserver_delivery)
 209         userdom_manage_user_home_content_sockets($1,mailserver_delivery)
 210         userdom_user_home_dir_filetrans_user_home_content($1,mailserver_delivery,{ dir file lnk_file fifo_file sock_file })
 211         # Read user temporary files.
 212         userdom_read_user_tmp_files($1,$1_mail_t)
 213         userdom_dontaudit_append_user_tmp_files($1,$1_mail_t)
 214         # cjp: this should probably be read all user tmp
 215         # files in an appropriate place for mta_user_agent
 216         userdom_read_user_tmp_files($1,mta_user_agent)
 217
 218         tunable_policy(`use_samba_home_dirs',`
 219                 fs_manage_cifs_files($1_mail_t)
 220                 fs_manage_cifs_symlinks($1_mail_t)
 221         ')
 222
 223         optional_policy(`
 224                 allow $1_mail_t self:capability dac_override;
 225
 226                 # Read user temporary files.
 227                 # postfix seems to need write access if the file handle is opened read/write
 228                 userdom_rw_user_tmp_files($1,$1_mail_t)
 229
 230                 postfix_read_config($1_mail_t)
 231                 postfix_list_spool($1_mail_t)
 232         ')
 233 ')
 234
 235 ########################################
 236 ## <summary>
 237 ##      Provide extra permissions for admin users
 238 ##      mail domain.
 239 ## </summary>
 240 ## <param name="userdomain_prefix">
 241 ##      <summary>
 242 ##      The prefix of the user domain (e.g., user
 243 ##      is the prefix for user_t).
 244 ##      </summary>
 245 ## </param>
 246 ## <param name="user_domain">
 247 ##      <summary>
 248 ##      The type of the user domain.
 249 ##      </summary>
 250 ## </param>
 251 ## <rolecap/>
 252 #
 253 template(`mta_admin_template',`
 254         gen_require(`
 255                 type $1_mail_t;
 256         ')
 257
 258         ifdef(`strict_policy',`
 259                 # allow the sysadmin to do "mail someone < /home/user/whatever"
 260                 userdom_read_unpriv_users_home_content_files($1_mail_t)
 261         ')
 262
 263         optional_policy(`
 264                 gen_require(`
 265                         attribute mta_user_agent;
 266                         type etc_aliases_t;
 267                 ')
 268
 269                 allow mta_user_agent $2:fifo_file { read write };
 270
 271                 manage_dirs_pattern($1_mail_t,etc_aliases_t,etc_aliases_t)
 272                 manage_files_pattern($1_mail_t,etc_aliases_t,etc_aliases_t)
 273                 manage_lnk_files_pattern($1_mail_t,etc_aliases_t,etc_aliases_t)
 274                 manage_fifo_files_pattern($1_mail_t,etc_aliases_t,etc_aliases_t)
 275                 manage_sock_files_pattern($1_mail_t,etc_aliases_t,etc_aliases_t)
 276                 files_etc_filetrans($1_mail_t,etc_aliases_t,{ file lnk_file sock_file fifo_file })
 277
 278                 # postfix needs this for newaliases
 279                 files_getattr_tmp_dirs($1_mail_t)
 280
 281                 postfix_exec_master($1_mail_t)
 282
 283                 ifdef(`distro_redhat',`
 284                         # compatability for old default main.cf
 285                         postfix_config_filetrans($1_mail_t,etc_aliases_t,{ dir file lnk_file sock_file fifo_file })
 286                 ')
 287         ')
 288 ')
 289
 290 ########################################
 291 ## <summary>
 292 ##      Make the specified domain usable for a mail server.
 293 ## </summary>
 294 ## <param name="type">
 295 ##      <summary>
 296 ##      Type to be used as a mail server domain.
 297 ##      </summary>
 298 ## </param>
 299 #
 300 interface(`mta_mailserver',`
 301         gen_require(`
 302                 attribute mailserver_domain;
 303         ')
 304
 305         init_daemon_domain($1,$2)
 306         typeattribute $1 mailserver_domain;
 307 ')
 308
 309 ########################################
 310 ## <summary>
 311 ##      Modified mailserver interface for
 312 ##      sendmail daemon use.
 313 ## </summary>
 314 ## <desc>
 315 ##      <p>
 316 ##      A modified MTA mail server interface for
 317 ##      the sendmail program.  It's design does
 318 ##      not fit well with policy, and using the
 319 ##      regular interface causes a type_transition
 320 ##      conflict if direct running of init scripts
 321 ##      is enabled.
 322 ##      </p>
 323 ##      <p>
 324 ##      This interface should most likely only be used
 325 ##      by the sendmail policy.
 326 ##      </p>
 327 ## </desc>
 328 ## <param name="domain">
 329 ##      <summary>
 330 ##      The type to be used for the mail server.
 331 ##      </summary>
 332 ## </param>
 333 ## <param name="entry_point">
 334 ##      <summary>
 335 ##      The type to be used for the domain entry point program.
 336 ##      </summary>
 337 ## </param>
 338 interface(`mta_sendmail_mailserver',`
 339         gen_require(`
 340                 attribute mailserver_domain;
 341                 type sendmail_exec_t;
 342         ')
 343
 344         init_system_domain($1,sendmail_exec_t)
 345         typeattribute $1 mailserver_domain;
 346 ')
 347
 348 #######################################
 349 ## <summary>
 350 ##      Make a type a mailserver type used
 351 ##      for sending mail.
 352 ## </summary>
 353 ## <param name="domain">
 354 ##      <summary>
 355 ##      Mail server domain type used for sending mail.
 356 ##      </summary>
 357 ## </param>
 358 #
 359 interface(`mta_mailserver_sender',`
 360         gen_require(`
 361                 attribute mailserver_sender;
 362         ')
 363
 364         typeattribute $1 mailserver_sender;
 365 ')
 366
 367 #######################################
 368 ## <summary>
 369 ##      Make a type a mailserver type used
 370 ##      for delivering mail to local users.
 371 ## </summary>
 372 ## <param name="domain">
 373 ##      <summary>
 374 ##      Mail server domain type used for delivering mail.
 375 ##      </summary>
 376 ## </param>
 377 #
 378 interface(`mta_mailserver_delivery',`
 379         gen_require(`
 380                 attribute mailserver_delivery;
 381                 type mail_spool_t;
 382         ')
 383
 384         typeattribute $1 mailserver_delivery;
 385
 386         allow $1 mail_spool_t:dir list_dir_perms;
 387         create_files_pattern($1,mail_spool_t,mail_spool_t)
 388         read_files_pattern($1,mail_spool_t,mail_spool_t)
 389         create_lnk_files_pattern($1,mail_spool_t,mail_spool_t)
 390         read_lnk_files_pattern($1,mail_spool_t,mail_spool_t)
 391
 392         optional_policy(`
 393                 dovecot_manage_spool($1)
 394         ')
 395
 396         optional_policy(`
 397                 # so MTA can access /var/lib/mailman/mail/wrapper
 398                 files_search_var_lib($1)
 399
 400                 mailman_domtrans($1)
 401                 mailman_read_data_symlinks($1)
 402         ')
 403 ')
 404
 405 #######################################
 406 ## <summary>
 407 ##      Make a type a mailserver type used
 408 ##      for sending mail on behalf of local
 409 ##      users to the local mail spool.
 410 ## </summary>
 411 ## <param name="domain">
 412 ##      <summary>
 413 ##      Mail server domain type used for sending local mail.
 414 ##      </summary>
 415 ## </param>
 416 #
 417 interface(`mta_mailserver_user_agent',`
 418         gen_require(`
 419                 attribute mta_user_agent;
 420         ')
 421
 422         typeattribute $1 mta_user_agent;
 423
 424         optional_policy(`
 425                 # apache should set close-on-exec
 426                 apache_dontaudit_rw_stream_sockets($1)
 427                 apache_dontaudit_rw_sys_script_stream_sockets($1)
 428         ')
 429 ')
 430
 431 ########################################
 432 ## <summary>
 433 ##      Send mail from the system.
 434 ## </summary>
 435 ## <param name="domain">
 436 ##      <summary>
 437 ##      Domain allowed access.
 438 ##      </summary>
 439 ## </param>
 440 #
 441 interface(`mta_send_mail',`
 442         gen_require(`
 443                 attribute mta_user_agent;
 444                 type system_mail_t, sendmail_exec_t;
 445         ')
 446
 447         allow $1 sendmail_exec_t:lnk_file read_lnk_file_perms;
 448         domain_auto_trans($1, sendmail_exec_t, system_mail_t)
 449
 450         allow $1 system_mail_t:fd use;
 451         allow system_mail_t $1:fd use;
 452         allow system_mail_t $1:fifo_file rw_file_perms;
 453         allow system_mail_t $1:process sigchld;
 454
 455         allow mta_user_agent $1:fd use;
 456         allow mta_user_agent $1:process sigchld;
 457         allow mta_user_agent $1:fifo_file { read write };
 458 ')
 459
 460 ########################################
 461 ## <summary>
 462 ##      Execute send mail in a specified domain.
 463 ## </summary>
 464 ## <desc>
 465 ##      <p>
 466 ##      Execute send mail in a specified domain.
 467 ##      </p>
 468 ##      <p>
 469 ##      No interprocess communication (signals, pipes,
 470 ##      etc.) is provided by this interface since
 471 ##      the domains are not owned by this module.
 472 ##      </p>
 473 ## </desc>
 474 ## <param name="source_domain">
 475 ##      <summary>
 476 ##      Domain to transition from.
 477 ##      </summary>
 478 ## </param>
 479 ## <param name="target_domain">
 480 ##      <summary>
 481 ##      Domain to transition to.
 482 ##      </summary>
 483 ## </param>
 484 #
 485 interface(`mta_sendmail_domtrans',`
 486         gen_require(`
 487                 type sendmail_exec_t;
 488         ')
 489
 490         files_search_usr($1)
 491         corecmd_read_sbin_symlinks($1)
 492         domain_auto_trans($1,sendmail_exec_t,$2)
 493 ')
 494
 495 ########################################
 496 ## <summary>
 497 ##      Execute sendmail in the caller domain.
 498 ## </summary>
 499 ## <param name="domain">
 500 ##      <summary>
 501 ##      Domain allowed access.
 502 ##      </summary>
 503 ## </param>
 504 #
 505 interface(`mta_sendmail_exec',`
 506         gen_require(`
 507                 type sendmail_exec_t;
 508         ')
 509
 510         can_exec($1, sendmail_exec_t)
 511 ')
 512
 513 ########################################
 514 ## <summary>
 515 ##      Read mail server configuration.
 516 ## </summary>
 517 ## <param name="domain">
 518 ##      <summary>
 519 ##      Domain allowed access.
 520 ##      </summary>
 521 ## </param>
 522 ## <rolecap/>
 523 #
 524 interface(`mta_read_config',`
 525         gen_require(`
 526                 type etc_mail_t;
 527         ')
 528
 529         files_search_etc($1)
 530         allow $1 etc_mail_t:dir list_dir_perms;
 531         read_files_pattern($1,etc_mail_t,etc_mail_t)
 532         read_lnk_files_pattern($1,etc_mail_t,etc_mail_t)
 533 ')
 534
 535 ########################################
 536 ## <summary>
 537 ##      Read mail address aliases.
 538 ## </summary>
 539 ## <param name="domain">
 540 ##      <summary>
 541 ##      Domain allowed access.
 542 ##      </summary>
 543 ## </param>
 544 #
 545 interface(`mta_read_aliases',`
 546         gen_require(`
 547                 type etc_aliases_t;
 548         ')
 549
 550         files_search_etc($1)
 551         allow $1 etc_aliases_t:file read_file_perms;
 552 ')
 553
 554 ########################################
 555 ## <summary>
 556 ##      Type transition files created in /etc
 557 ##      to the mail address aliases type.
 558 ## </summary>
 559 ## <param name="domain">
 560 ##      <summary>
 561 ##      Domain allowed access.
 562 ##      </summary>
 563 ## </param>
 564 #
 565 interface(`mta_etc_filetrans_aliases',`
 566         gen_require(`
 567                 type etc_aliases_t;
 568         ')
 569
 570         files_etc_filetrans($1,etc_aliases_t, file)
 571 ')
 572
 573 ########################################
 574 ## <summary>
 575 ##      Read and write mail aliases.
 576 ## </summary>
 577 ## <param name="domain">
 578 ##      <summary>
 579 ##      Domain allowed access.
 580 ##      </summary>
 581 ## </param>
 582 ## <rolecap/>
 583 #
 584 interface(`mta_rw_aliases',`
 585         gen_require(`
 586                 type etc_aliases_t;
 587         ')
 588
 589         files_search_etc($1)
 590         allow $1 etc_aliases_t:file { rw_file_perms setattr };
 591 ')
 592
 593 #######################################
 594 ## <summary>
 595 ##      Do not audit attempts to read and write TCP
 596 ##      sockets of mail delivery domains.
 597 ## </summary>
 598 ## <param name="domain">
 599 ##      <summary>
 600 ##      Mail server domain.
 601 ##      </summary>
 602 ## </param>
 603 #
 604 interface(`mta_dontaudit_rw_delivery_tcp_sockets',`
 605         gen_require(`
 606                 attribute mailserver_delivery;
 607         ')
 608
 609         dontaudit $1 mailserver_delivery:tcp_socket { read write };
 610 ')
 611
 612 #######################################
 613 ## <summary>
 614 ##      Connect to all mail servers over TCP.  (Deprecated)
 615 ## </summary>
 616 ## <param name="domain">
 617 ##      <summary>
 618 ##      Mail server domain.
 619 ##      </summary>
 620 ## </param>
 621 #
 622 interface(`mta_tcp_connect_all_mailservers',`
 623         refpolicywarn(`$0($*) has been deprecated.')
 624 ')
 625
 626 #######################################
 627 ## <summary>
 628 ##      Do not audit attempts to read a symlink
 629 ##      in the mail spool.
 630 ## </summary>
 631 ## <param name="domain">
 632 ##      <summary>
 633 ##      Domain allowed access.
 634 ##      </summary>
 635 ## </param>
 636 #
 637 interface(`mta_dontaudit_read_spool_symlinks',`
 638         gen_require(`
 639                 type mail_spool_t;
 640         ')
 641
 642         dontaudit $1 mail_spool_t:lnk_file read;
 643 ')
 644
 645 ########################################
 646 ## <summary>
 647 ##      Get the attributes of mail spool files.
 648 ## </summary>
 649 ## <param name="domain">
 650 ##      <summary>
 651 ##      Domain allowed access.
 652 ##      </summary>
 653 ## </param>
 654 #
 655 interface(`mta_getattr_spool',`
 656         gen_require(`
 657                 type mail_spool_t;
 658         ')
 659
 660         files_search_spool($1)
 661         allow $1 mail_spool_t:dir list_dir_perms;
 662         allow $1 mail_spool_t:lnk_file read;
 663         allow $1 mail_spool_t:file getattr;
 664 ')
 665
 666 ########################################
 667 ## <summary>
 668 ##      Do not audit attempts to get the attributes
 669 ##      of mail spool files.
 670 ## </summary>
 671 ## <param name="domain">
 672 ##      <summary>
 673 ##      Domain to not audit.
 674 ##      </summary>
 675 ## </param>
 676 #
 677 interface(`mta_dontaudit_getattr_spool_files',`
 678         gen_require(`
 679                 type mail_spool_t;
 680         ')
 681
 682         files_dontaudit_search_spool($1)
 683         dontaudit $1 mail_spool_t:dir search;
 684         dontaudit $1 mail_spool_t:lnk_file read;
 685         dontaudit $1 mail_spool_t:file getattr;
 686 ')
 687
 688 #######################################
 689 ## <summary>
 690 ##      Create private objects in the
 691 ##      mail spool directory.
 692 ## </summary>
 693 ## <param name="domain">
 694 ##      <summary>
 695 ##      Domain allowed access.
 696 ##      </summary>
 697 ## </param>
 698 ## <param name="private type">
 699 ##      <summary>
 700 ##      The type of the object to be created.
 701 ##      </summary>
 702 ## </param>
 703 ## <param name="object">
 704 ##      <summary>
 705 ##      The object class of the object being created.
 706 ##      </summary>
 707 ## </param>
 708 #
 709 interface(`mta_spool_filetrans',`
 710         gen_require(`
 711                 type mail_spool_t;
 712         ')
 713
 714         files_search_spool($1)
 715         filetrans_pattern($1,mail_spool_t,$2,$3)
 716 ')
 717
 718 ########################################
 719 ## <summary>
 720 ##      Read and write the mail spool.
 721 ## </summary>
 722 ## <param name="domain">
 723 ##      <summary>
 724 ##      Domain allowed access.
 725 ##      </summary>
 726 ## </param>
 727 #
 728 interface(`mta_rw_spool',`
 729         gen_require(`
 730                 type mail_spool_t;
 731         ')
 732
 733         files_search_spool($1)
 734         allow $1 mail_spool_t:dir list_dir_perms;
 735         allow $1 mail_spool_t:file setattr;
 736         rw_files_pattern($1,mail_spool_t,mail_spool_t)
 737         read_lnk_files_pattern($1,mail_spool_t,mail_spool_t)
 738 ')
 739
 740 #######################################
 741 ## <summary>
 742 ##      Create, read, and write the mail spool.
 743 ## </summary>
 744 ## <param name="domain">
 745 ##      <summary>
 746 ##      Domain allowed access.
 747 ##      </summary>
 748 ## </param>
 749 #
 750 interface(`mta_append_spool',`
 751         gen_require(`
 752                 type mail_spool_t;
 753         ')
 754
 755         files_search_spool($1)
 756         allow $1 mail_spool_t:dir list_dir_perms;
 757         create_files_pattern($1,mail_spool_t,mail_spool_t)
 758         write_files_pattern($1,mail_spool_t,mail_spool_t)
 759         read_lnk_files_pattern($1,mail_spool_t,mail_spool_t)
 760 ')
 761
 762 #######################################
 763 ## <summary>
 764 ##      Delete from the mail spool.
 765 ## </summary>
 766 ## <param name="domain">
 767 ##      <summary>
 768 ##      Domain allowed access.
 769 ##      </summary>
 770 ## </param>
 771 #
 772 interface(`mta_delete_spool',`
 773         gen_require(`
 774                 type mail_spool_t;
 775         ')
 776
 777         files_search_spool($1)
 778         delete_files_pattern($1,mail_spool_t,mail_spool_t)
 779 ')
 780
 781 ########################################
 782 ## <summary>
 783 ##      Create, read, write, and delete mail spool files.
 784 ## </summary>
 785 ## <param name="domain">
 786 ##      <summary>
 787 ##      Domain allowed access.
 788 ##      </summary>
 789 ## </param>
 790 #
 791 interface(`mta_manage_spool',`
 792         gen_require(`
 793                 type mail_spool_t;
 794         ')
 795
 796         files_search_spool($1)
 797         manage_dirs_pattern($1,mail_spool_t,mail_spool_t)
 798         manage_files_pattern($1,mail_spool_t,mail_spool_t)
 799         manage_lnk_files_pattern($1,mail_spool_t,mail_spool_t)
 800 ')
 801
 802 #######################################
 803 ## <summary>
 804 ##      Do not audit attempts to read and
 805 ##      write the mail queue.
 806 ## </summary>
 807 ## <param name="domain">
 808 ##      <summary>
 809 ##      Domain to not audit.
 810 ##      </summary>
 811 ## </param>
 812 #
 813 interface(`mta_dontaudit_rw_queue',`
 814         gen_require(`
 815                 type mqueue_spool_t;
 816         ')
 817
 818         dontaudit $1 mqueue_spool_t:dir search_dir_perms;
 819         dontaudit $1 mqueue_spool_t:file { getattr read write };
 820 ')
 821
 822 ########################################
 823 ## <summary>
 824 ##      Create, read, write, and delete
 825 ##      mail queue files.
 826 ## </summary>
 827 ## <param name="domain">
 828 ##      <summary>
 829 ##      Domain allowed access.
 830 ##      </summary>
 831 ## </param>
 832 #
 833 interface(`mta_manage_queue',`
 834         gen_require(`
 835                 type mqueue_spool_t;
 836         ')
 837
 838         files_search_spool($1)
 839         manage_files_pattern($1,mqueue_spool_t,mqueue_spool_t)
 840 ')
 841
 842 #######################################
 843 ## <summary>
 844 ##      Read sendmail binary.
 845 ## </summary>
 846 ## <param name="domain">
 847 ##      <summary>
 848 ##      Domain allowed access.
 849 ##      </summary>
 850 ## </param>
 851 #
 852 # cjp: added for postfix
 853 interface(`mta_read_sendmail_bin',`
 854         gen_require(`
 855                 type sendmail_exec_t;
 856         ')
 857
 858         allow $1 sendmail_exec_t:file read_file_perms;
 859 ')
 860
 861 #######################################
 862 ## <summary>
 863 ##      Read and write unix domain stream sockets
 864 ##      of user mail domains.
 865 ## </summary>
 866 ## <param name="domain">
 867 ##      <summary>
 868 ##      Domain allowed access.
 869 ##      </summary>
 870 ## </param>
 871 #
 872 interface(`mta_rw_user_mail_stream_sockets',`
 873         gen_require(`
 874                 attribute user_mail_domain;
 875         ')
 876
 877         allow $1 user_mail_domain:unix_stream_socket rw_socket_perms;
 878 ')