2 policy_module(mta,1.6.2)
4 ########################################
9 attribute mta_user_agent;
10 attribute mailserver_delivery;
11 attribute mailserver_domain;
12 attribute mailserver_sender;
14 attribute user_mail_domain;
17 files_type(etc_aliases_t)
20 files_config_file(etc_mail_t)
23 files_type(mqueue_spool_t)
26 files_type(mail_spool_t)
29 files_type(sendmail_exec_t)
31 mta_base_mail_template(system)
32 role system_r types system_mail_t;
34 # cjp: need to resolve this, but require{}
35 # does not work in the else part of the optional
36 #ifdef(`strict_policy',`
37 # optional_policy(`',`
38 # init_system_domain(system_mail_t,sendmail_exec_t)
42 ########################################
44 # System mail local policy
47 # newalias required this, not sure if it is needed in 'if' file
48 allow system_mail_t self:capability { dac_override };
50 read_files_pattern(system_mail_t,etc_mail_t,etc_mail_t)
52 kernel_read_system_state(system_mail_t)
53 kernel_read_network_state(system_mail_t)
55 dev_read_rand(system_mail_t)
56 dev_read_urand(system_mail_t)
58 init_use_script_ptys(system_mail_t)
60 userdom_use_sysadm_terms(system_mail_t)
61 userdom_dontaudit_search_sysadm_home_dirs(system_mail_t)
63 ifdef(`targeted_policy',`
64 typealias system_mail_t alias sysadm_mail_t;
66 manage_dirs_pattern(system_mail_t,mail_spool_t,mail_spool_t)
67 manage_files_pattern(system_mail_t,mail_spool_t,mail_spool_t)
68 manage_lnk_files_pattern(system_mail_t,mail_spool_t,mail_spool_t)
69 manage_fifo_files_pattern(system_mail_t,mail_spool_t,mail_spool_t)
71 # for reading .forward - maybe we need a new type for it?
72 # also for delivering mail to maildir
73 userdom_manage_generic_user_home_content_dirs(mailserver_delivery)
74 userdom_manage_generic_user_home_content_files(mailserver_delivery)
75 userdom_manage_generic_user_home_content_symlinks(mailserver_delivery)
76 userdom_manage_generic_user_home_content_sockets(mailserver_delivery)
77 userdom_manage_generic_user_home_content_pipes(mailserver_delivery)
78 userdom_generic_user_home_dir_filetrans_generic_user_home_content(mailserver_delivery,{ dir file lnk_file sock_file fifo_file })
80 # cjp: another require-in-else to resolve
81 # optional_policy(`',`
82 corecmd_exec_all_executables(system_mail_t)
84 files_exec_etc_files(system_mail_t)
86 libs_exec_ld_so(system_mail_t)
87 libs_exec_lib_files(system_mail_t)
92 apache_read_squirrelmail_data(system_mail_t)
93 apache_append_squirrelmail_data(system_mail_t)
95 # apache should set close-on-exec
96 apache_dontaudit_append_log(system_mail_t)
97 apache_dontaudit_rw_stream_sockets(system_mail_t)
98 apache_dontaudit_rw_tcp_sockets(system_mail_t)
99 apache_dontaudit_rw_sys_script_stream_sockets(system_mail_t)
103 arpwatch_manage_tmp_files(system_mail_t)
105 ifdef(`hide_broken_symptoms', `
106 arpwatch_dontaudit_rw_packet_sockets(system_mail_t)
111 cron_read_system_job_tmp_files(system_mail_t)
112 cron_dontaudit_write_pipes(system_mail_t)
116 cvs_read_data(system_mail_t)
120 logrotate_read_tmp_files(system_mail_t)
124 logwatch_read_tmp_files(system_mail_t)
128 nagios_read_tmp_files(system_mail_t)
132 manage_dirs_pattern(system_mail_t,etc_aliases_t,etc_aliases_t)
133 manage_files_pattern(system_mail_t,etc_aliases_t,etc_aliases_t)
134 manage_lnk_files_pattern(system_mail_t,etc_aliases_t,etc_aliases_t)
135 manage_fifo_files_pattern(system_mail_t,etc_aliases_t,etc_aliases_t)
136 manage_sock_files_pattern(system_mail_t,etc_aliases_t,etc_aliases_t)
137 files_etc_filetrans(system_mail_t,etc_aliases_t,{ file lnk_file sock_file fifo_file })
139 domain_use_interactive_fds(system_mail_t)
141 # postfix needs this for newaliases
142 files_getattr_tmp_dirs(system_mail_t)
144 postfix_exec_master(system_mail_t)
145 postfix_read_config(system_mail_t)
146 postfix_search_spool(system_mail_t)
148 ifdef(`distro_redhat',`
149 # compatability for old default main.cf
150 postfix_config_filetrans(system_mail_t,etc_aliases_t,{ dir file lnk_file sock_file fifo_file })
154 cron_rw_tcp_sockets(system_mail_t)
159 qmail_domtrans_inject(system_mail_t)
163 sxid_read_log(system_mail_t)
167 userdom_dontaudit_use_unpriv_users_ptys(system_mail_t)
170 cron_dontaudit_append_system_job_tmp_files(system_mail_t)
175 smartmon_read_tmp_files(system_mail_t)
178 # should break this up among sections:
181 # why is mail delivered to a directory of type arpwatch_data_t?
182 arpwatch_search_data(mailserver_delivery)
183 arpwatch_manage_tmp_files(mta_user_agent)
184 ifdef(`hide_broken_symptoms', `
185 arpwatch_dontaudit_rw_packet_sockets(mta_user_agent)
188 cron_read_system_job_tmp_files(mta_user_agent)