policy/modules/services/mta.te

   1
   2 policy_module(mta,1.7.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 attribute mta_user_agent;
  10 attribute mailserver_delivery;
  11 attribute mailserver_domain;
  12 attribute mailserver_sender;
  13
  14 attribute user_mail_domain;
  15
  16 type etc_aliases_t;
  17 files_type(etc_aliases_t)
  18
  19 type etc_mail_t;
  20 files_config_file(etc_mail_t)
  21
  22 type mqueue_spool_t;
  23 files_type(mqueue_spool_t)
  24
  25 type mail_spool_t;
  26 files_type(mail_spool_t)
  27
  28 type sendmail_exec_t;
  29 files_type(sendmail_exec_t)
  30
  31 mta_base_mail_template(system)
  32 role system_r types system_mail_t;
  33
  34 # cjp: need to resolve this, but require{}
  35 # does not work in the else part of the optional
  36 #ifdef(`strict_policy',`
  37 #       optional_policy(`',`
  38 #               init_system_domain(system_mail_t,sendmail_exec_t)
  39 #       ')
  40 #')
  41
  42 ########################################
  43 #
  44 # System mail local policy
  45 #
  46
  47 # newalias required this, not sure if it is needed in 'if' file
  48 allow system_mail_t self:capability { dac_override };
  49
  50 read_files_pattern(system_mail_t,etc_mail_t,etc_mail_t)
  51
  52 kernel_read_system_state(system_mail_t)
  53 kernel_read_network_state(system_mail_t)
  54
  55 dev_read_rand(system_mail_t)
  56 dev_read_urand(system_mail_t)
  57
  58 init_use_script_ptys(system_mail_t)
  59
  60 userdom_use_sysadm_terms(system_mail_t)
  61 userdom_dontaudit_search_sysadm_home_dirs(system_mail_t)
  62
  63 ifdef(`targeted_policy',`
  64         typealias system_mail_t alias sysadm_mail_t;
  65
  66         manage_dirs_pattern(system_mail_t,mail_spool_t,mail_spool_t)
  67         manage_files_pattern(system_mail_t,mail_spool_t,mail_spool_t)
  68         manage_lnk_files_pattern(system_mail_t,mail_spool_t,mail_spool_t)
  69         manage_fifo_files_pattern(system_mail_t,mail_spool_t,mail_spool_t)
  70
  71         # for reading .forward - maybe we need a new type for it?
  72         # also for delivering mail to maildir
  73         userdom_manage_generic_user_home_content_dirs(mailserver_delivery)
  74         userdom_manage_generic_user_home_content_files(mailserver_delivery)
  75         userdom_manage_generic_user_home_content_symlinks(mailserver_delivery)
  76         userdom_manage_generic_user_home_content_sockets(mailserver_delivery)
  77         userdom_manage_generic_user_home_content_pipes(mailserver_delivery)
  78         userdom_generic_user_home_dir_filetrans_generic_user_home_content(mailserver_delivery,{ dir file lnk_file sock_file fifo_file })
  79
  80 # cjp: another require-in-else to resolve
  81 #       optional_policy(`',`
  82                 corecmd_exec_all_executables(system_mail_t)
  83
  84                 files_exec_etc_files(system_mail_t)
  85
  86                 libs_exec_ld_so(system_mail_t)
  87                 libs_exec_lib_files(system_mail_t)
  88 #       ')
  89 ')
  90
  91 optional_policy(`
  92         apache_read_squirrelmail_data(system_mail_t)
  93         apache_append_squirrelmail_data(system_mail_t)
  94
  95         # apache should set close-on-exec
  96         apache_dontaudit_append_log(system_mail_t)
  97         apache_dontaudit_rw_stream_sockets(system_mail_t)
  98         apache_dontaudit_rw_tcp_sockets(system_mail_t)
  99         apache_dontaudit_rw_sys_script_stream_sockets(system_mail_t)
 100 ')
 101
 102 optional_policy(`
 103         arpwatch_manage_tmp_files(system_mail_t)
 104
 105         ifdef(`hide_broken_symptoms', `
 106                 arpwatch_dontaudit_rw_packet_sockets(system_mail_t)
 107         ')
 108 ')
 109
 110 optional_policy(`
 111         cron_read_system_job_tmp_files(system_mail_t)
 112         cron_dontaudit_write_pipes(system_mail_t)
 113 ')
 114
 115 optional_policy(`
 116         cvs_read_data(system_mail_t)
 117 ')
 118
 119 optional_policy(`
 120         logrotate_read_tmp_files(system_mail_t)
 121 ')
 122
 123 optional_policy(`
 124         logwatch_read_tmp_files(system_mail_t)
 125 ')
 126
 127 optional_policy(`
 128         nagios_read_tmp_files(system_mail_t)
 129 ')
 130
 131 optional_policy(`
 132         manage_dirs_pattern(system_mail_t,etc_aliases_t,etc_aliases_t)
 133         manage_files_pattern(system_mail_t,etc_aliases_t,etc_aliases_t)
 134         manage_lnk_files_pattern(system_mail_t,etc_aliases_t,etc_aliases_t)
 135         manage_fifo_files_pattern(system_mail_t,etc_aliases_t,etc_aliases_t)
 136         manage_sock_files_pattern(system_mail_t,etc_aliases_t,etc_aliases_t)
 137         files_etc_filetrans(system_mail_t,etc_aliases_t,{ file lnk_file sock_file fifo_file })
 138
 139         domain_use_interactive_fds(system_mail_t)
 140
 141         # postfix needs this for newaliases
 142         files_getattr_tmp_dirs(system_mail_t)
 143
 144         postfix_exec_master(system_mail_t)
 145         postfix_read_config(system_mail_t)
 146         postfix_search_spool(system_mail_t)
 147
 148         ifdef(`distro_redhat',`
 149                 # compatability for old default main.cf
 150                 postfix_config_filetrans(system_mail_t,etc_aliases_t,{ dir file lnk_file sock_file fifo_file })
 151         ')
 152
 153         optional_policy(`
 154                 cron_rw_tcp_sockets(system_mail_t)
 155         ')
 156 ')
 157
 158 optional_policy(`
 159         qmail_domtrans_inject(system_mail_t)
 160 ')
 161
 162 optional_policy(`
 163         sxid_read_log(system_mail_t)
 164 ')
 165
 166 optional_policy(`
 167         userdom_dontaudit_use_unpriv_users_ptys(system_mail_t)
 168
 169         optional_policy(`
 170                 cron_dontaudit_append_system_job_tmp_files(system_mail_t)
 171         ')
 172 ')
 173
 174 optional_policy(`
 175         smartmon_read_tmp_files(system_mail_t)
 176 ')
 177
 178 # should break this up among sections:
 179
 180 optional_policy(`
 181         # why is mail delivered to a directory of type arpwatch_data_t?
 182         arpwatch_search_data(mailserver_delivery)
 183         arpwatch_manage_tmp_files(mta_user_agent)
 184         ifdef(`hide_broken_symptoms', `
 185                 arpwatch_dontaudit_rw_packet_sockets(mta_user_agent)
 186         ')
 187         optional_policy(`
 188                 cron_read_system_job_tmp_files(mta_user_agent)
 189         ')
 190 ')