policy/modules/services/mta.te

   1
   2 policy_module(mta, 2.0.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 attribute mailcontent_type;
  10 attribute mta_exec_type;
  11 attribute mta_user_agent;
  12 attribute mailserver_delivery;
  13 attribute mailserver_domain;
  14 attribute mailserver_sender;
  15
  16 attribute user_mail_domain;
  17
  18 type etc_aliases_t;
  19 files_type(etc_aliases_t)
  20
  21 type etc_mail_t;
  22 files_config_file(etc_mail_t)
  23
  24 type mqueue_spool_t;
  25 files_mountpoint(mqueue_spool_t)
  26
  27 type mail_spool_t;
  28 files_mountpoint(mail_spool_t)
  29
  30 type sendmail_exec_t;
  31 mta_agent_executable(sendmail_exec_t)
  32
  33 mta_base_mail_template(system)
  34 role system_r types system_mail_t;
  35
  36 mta_base_mail_template(user)
  37 typealias user_mail_t alias { staff_mail_t sysadm_mail_t };
  38 typealias user_mail_t alias { auditadm_mail_t secadm_mail_t };
  39 typealias user_mail_tmp_t alias { staff_mail_tmp_t sysadm_mail_tmp_t };
  40 typealias user_mail_tmp_t alias { auditadm_mail_tmp_t secadm_mail_tmp_t };
  41 ubac_constrained(user_mail_t)
  42 ubac_constrained(user_mail_tmp_t)
  43
  44 ########################################
  45 #
  46 # System mail local policy
  47 #
  48
  49 # newalias required this, not sure if it is needed in 'if' file
  50 allow system_mail_t self:capability { dac_override };
  51
  52 read_files_pattern(system_mail_t, etc_mail_t, etc_mail_t)
  53
  54 allow system_mail_t mta_exec_type:file entrypoint;
  55
  56 allow system_mail_t mailcontent_type:file read_file_perms;
  57
  58 kernel_read_system_state(system_mail_t)
  59 kernel_read_network_state(system_mail_t)
  60
  61 dev_read_rand(system_mail_t)
  62 dev_read_urand(system_mail_t)
  63
  64 init_use_script_ptys(system_mail_t)
  65
  66 userdom_use_user_terminals(system_mail_t)
  67 userdom_dontaudit_search_user_home_dirs(system_mail_t)
  68
  69 optional_policy(`
  70         apache_read_squirrelmail_data(system_mail_t)
  71         apache_append_squirrelmail_data(system_mail_t)
  72
  73         # apache should set close-on-exec
  74         apache_dontaudit_append_log(system_mail_t)
  75         apache_dontaudit_rw_stream_sockets(system_mail_t)
  76         apache_dontaudit_rw_tcp_sockets(system_mail_t)
  77         apache_dontaudit_rw_sys_script_stream_sockets(system_mail_t)
  78 ')
  79
  80 optional_policy(`
  81         arpwatch_manage_tmp_files(system_mail_t)
  82
  83         ifdef(`hide_broken_symptoms', `
  84                 arpwatch_dontaudit_rw_packet_sockets(system_mail_t)
  85         ')
  86 ')
  87
  88 optional_policy(`
  89         cron_read_system_job_tmp_files(system_mail_t)
  90         cron_dontaudit_write_pipes(system_mail_t)
  91 ')
  92
  93 optional_policy(`
  94         cvs_read_data(system_mail_t)
  95 ')
  96
  97 optional_policy(`
  98         logrotate_read_tmp_files(system_mail_t)
  99 ')
 100
 101 optional_policy(`
 102         logwatch_read_tmp_files(system_mail_t)
 103 ')
 104
 105 optional_policy(`
 106         nagios_read_tmp_files(system_mail_t)
 107 ')
 108
 109 optional_policy(`
 110         manage_dirs_pattern(system_mail_t, etc_aliases_t, etc_aliases_t)
 111         manage_files_pattern(system_mail_t, etc_aliases_t, etc_aliases_t)
 112         manage_lnk_files_pattern(system_mail_t, etc_aliases_t, etc_aliases_t)
 113         manage_fifo_files_pattern(system_mail_t, etc_aliases_t, etc_aliases_t)
 114         manage_sock_files_pattern(system_mail_t, etc_aliases_t, etc_aliases_t)
 115         files_etc_filetrans(system_mail_t, etc_aliases_t, { file lnk_file sock_file fifo_file })
 116
 117         domain_use_interactive_fds(system_mail_t)
 118
 119         # postfix needs this for newaliases
 120         files_getattr_tmp_dirs(system_mail_t)
 121
 122         postfix_exec_master(system_mail_t)
 123         postfix_read_config(system_mail_t)
 124         postfix_search_spool(system_mail_t)
 125
 126         ifdef(`distro_redhat',`
 127                 # compatability for old default main.cf
 128                 postfix_config_filetrans(system_mail_t, etc_aliases_t, { dir file lnk_file sock_file fifo_file })
 129         ')
 130
 131         optional_policy(`
 132                 cron_rw_tcp_sockets(system_mail_t)
 133         ')
 134 ')
 135
 136 optional_policy(`
 137         qmail_domtrans_inject(system_mail_t)
 138 ')
 139
 140 optional_policy(`
 141         sxid_read_log(system_mail_t)
 142 ')
 143
 144 optional_policy(`
 145         userdom_dontaudit_use_user_ptys(system_mail_t)
 146
 147         optional_policy(`
 148                 cron_dontaudit_append_system_job_tmp_files(system_mail_t)
 149         ')
 150 ')
 151
 152 optional_policy(`
 153         smartmon_read_tmp_files(system_mail_t)
 154 ')
 155
 156 # should break this up among sections:
 157
 158 optional_policy(`
 159         # why is mail delivered to a directory of type arpwatch_data_t?
 160         arpwatch_search_data(mailserver_delivery)
 161         arpwatch_manage_tmp_files(mta_user_agent)
 162
 163         ifdef(`hide_broken_symptoms', `
 164                 arpwatch_dontaudit_rw_packet_sockets(mta_user_agent)
 165         ')
 166
 167         optional_policy(`
 168                 cron_read_system_job_tmp_files(mta_user_agent)
 169         ')
 170 ')
 171
 172 ########################################
 173 #
 174 # User send mail local policy
 175 #
 176
 177 domain_use_interactive_fds(user_mail_t)
 178
 179 userdom_use_user_terminals(user_mail_t)
 180 # Write to the user domain tty. cjp: why?
 181 userdom_use_user_terminals(mta_user_agent)
 182 # Create dead.letter in user home directories.
 183 userdom_manage_user_home_content_files(user_mail_t)
 184 userdom_user_home_dir_filetrans_user_home_content(user_mail_t, file)
 185 # for reading .forward - maybe we need a new type for it?
 186 # also for delivering mail to maildir
 187 userdom_manage_user_home_content_dirs(mailserver_delivery)
 188 userdom_manage_user_home_content_files(mailserver_delivery)
 189 userdom_manage_user_home_content_symlinks(mailserver_delivery)
 190 userdom_manage_user_home_content_pipes(mailserver_delivery)
 191 userdom_manage_user_home_content_sockets(mailserver_delivery)
 192 userdom_user_home_dir_filetrans_user_home_content(mailserver_delivery, { dir file lnk_file fifo_file sock_file })
 193 # Read user temporary files.
 194 userdom_read_user_tmp_files(user_mail_t)
 195 userdom_dontaudit_append_user_tmp_files(user_mail_t)
 196 # cjp: this should probably be read all user tmp
 197 # files in an appropriate place for mta_user_agent
 198 userdom_read_user_tmp_files(mta_user_agent)
 199
 200 tunable_policy(`use_samba_home_dirs',`
 201         fs_manage_cifs_files(user_mail_t)
 202         fs_manage_cifs_symlinks(user_mail_t)
 203 ')
 204
 205 optional_policy(`
 206         allow user_mail_t self:capability dac_override;
 207
 208         # Read user temporary files.
 209         # postfix seems to need write access if the file handle is opened read/write
 210         userdom_rw_user_tmp_files(user_mail_t)
 211
 212         postfix_read_config(user_mail_t)
 213         postfix_list_spool(user_mail_t)
 214 ')