policy/modules/services/mta.te

   1
   2 policy_module(mta, 2.0.2)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 attribute mailcontent_type;
  10 attribute mta_exec_type;
  11 attribute mta_user_agent;
  12 attribute mailserver_delivery;
  13 attribute mailserver_domain;
  14 attribute mailserver_sender;
  15
  16 attribute user_mail_domain;
  17
  18 type etc_aliases_t;
  19 files_type(etc_aliases_t)
  20
  21 type etc_mail_t;
  22 files_config_file(etc_mail_t)
  23
  24 type mqueue_spool_t;
  25 files_mountpoint(mqueue_spool_t)
  26
  27 type mail_spool_t;
  28 files_mountpoint(mail_spool_t)
  29
  30 type sendmail_exec_t;
  31 mta_agent_executable(sendmail_exec_t)
  32
  33 mta_base_mail_template(system)
  34 role system_r types system_mail_t;
  35
  36 mta_base_mail_template(user)
  37 typealias user_mail_t alias { staff_mail_t sysadm_mail_t };
  38 typealias user_mail_t alias { auditadm_mail_t secadm_mail_t };
  39 typealias user_mail_tmp_t alias { staff_mail_tmp_t sysadm_mail_tmp_t };
  40 typealias user_mail_tmp_t alias { auditadm_mail_tmp_t secadm_mail_tmp_t };
  41 ubac_constrained(user_mail_t)
  42 ubac_constrained(user_mail_tmp_t)
  43
  44 ########################################
  45 #
  46 # System mail local policy
  47 #
  48
  49 # newalias required this, not sure if it is needed in 'if' file
  50 allow system_mail_t self:capability { dac_override };
  51
  52 read_files_pattern(system_mail_t, etc_mail_t, etc_mail_t)
  53
  54 allow system_mail_t mta_exec_type:file entrypoint;
  55
  56 allow system_mail_t mailcontent_type:file read_file_perms;
  57
  58 kernel_read_system_state(system_mail_t)
  59 kernel_read_network_state(system_mail_t)
  60
  61 dev_read_rand(system_mail_t)
  62 dev_read_urand(system_mail_t)
  63
  64 init_use_script_ptys(system_mail_t)
  65
  66 userdom_use_user_terminals(system_mail_t)
  67 userdom_dontaudit_search_user_home_dirs(system_mail_t)
  68
  69 optional_policy(`
  70         apache_read_squirrelmail_data(system_mail_t)
  71         apache_append_squirrelmail_data(system_mail_t)
  72
  73         # apache should set close-on-exec
  74         apache_dontaudit_append_log(system_mail_t)
  75         apache_dontaudit_rw_stream_sockets(system_mail_t)
  76         apache_dontaudit_rw_tcp_sockets(system_mail_t)
  77         apache_dontaudit_rw_sys_script_stream_sockets(system_mail_t)
  78 ')
  79
  80 optional_policy(`
  81         arpwatch_manage_tmp_files(system_mail_t)
  82
  83         ifdef(`hide_broken_symptoms', `
  84                 arpwatch_dontaudit_rw_packet_sockets(system_mail_t)
  85         ')
  86 ')
  87
  88 optional_policy(`
  89         cron_read_system_job_tmp_files(system_mail_t)
  90         cron_dontaudit_write_pipes(system_mail_t)
  91 ')
  92
  93 optional_policy(`
  94         cvs_read_data(system_mail_t)
  95 ')
  96
  97 optional_policy(`
  98         logrotate_read_tmp_files(system_mail_t)
  99 ')
 100
 101 optional_policy(`
 102         logwatch_read_tmp_files(system_mail_t)
 103 ')
 104
 105 optional_policy(`
 106         # newaliases runs as system_mail_t when the sendmail initscript does a restart
 107         milter_getattr_all_sockets(system_mail_t)
 108 ')
 109
 110 optional_policy(`
 111         nagios_read_tmp_files(system_mail_t)
 112 ')
 113
 114 optional_policy(`
 115         manage_dirs_pattern(system_mail_t, etc_aliases_t, etc_aliases_t)
 116         manage_files_pattern(system_mail_t, etc_aliases_t, etc_aliases_t)
 117         manage_lnk_files_pattern(system_mail_t, etc_aliases_t, etc_aliases_t)
 118         manage_fifo_files_pattern(system_mail_t, etc_aliases_t, etc_aliases_t)
 119         manage_sock_files_pattern(system_mail_t, etc_aliases_t, etc_aliases_t)
 120         files_etc_filetrans(system_mail_t, etc_aliases_t, { file lnk_file sock_file fifo_file })
 121
 122         domain_use_interactive_fds(system_mail_t)
 123
 124         # postfix needs this for newaliases
 125         files_getattr_tmp_dirs(system_mail_t)
 126
 127         postfix_exec_master(system_mail_t)
 128         postfix_read_config(system_mail_t)
 129         postfix_search_spool(system_mail_t)
 130
 131         ifdef(`distro_redhat',`
 132                 # compatability for old default main.cf
 133                 postfix_config_filetrans(system_mail_t, etc_aliases_t, { dir file lnk_file sock_file fifo_file })
 134         ')
 135
 136         optional_policy(`
 137                 cron_rw_tcp_sockets(system_mail_t)
 138         ')
 139 ')
 140
 141 optional_policy(`
 142         qmail_domtrans_inject(system_mail_t)
 143 ')
 144
 145 optional_policy(`
 146         sxid_read_log(system_mail_t)
 147 ')
 148
 149 optional_policy(`
 150         userdom_dontaudit_use_user_ptys(system_mail_t)
 151
 152         optional_policy(`
 153                 cron_dontaudit_append_system_job_tmp_files(system_mail_t)
 154         ')
 155 ')
 156
 157 optional_policy(`
 158         smartmon_read_tmp_files(system_mail_t)
 159 ')
 160
 161 # should break this up among sections:
 162
 163 optional_policy(`
 164         # why is mail delivered to a directory of type arpwatch_data_t?
 165         arpwatch_search_data(mailserver_delivery)
 166         arpwatch_manage_tmp_files(mta_user_agent)
 167
 168         ifdef(`hide_broken_symptoms', `
 169                 arpwatch_dontaudit_rw_packet_sockets(mta_user_agent)
 170         ')
 171
 172         optional_policy(`
 173                 cron_read_system_job_tmp_files(mta_user_agent)
 174         ')
 175 ')
 176
 177 ########################################
 178 #
 179 # User send mail local policy
 180 #
 181
 182 domain_use_interactive_fds(user_mail_t)
 183
 184 userdom_use_user_terminals(user_mail_t)
 185 # Write to the user domain tty. cjp: why?
 186 userdom_use_user_terminals(mta_user_agent)
 187 # Create dead.letter in user home directories.
 188 userdom_manage_user_home_content_files(user_mail_t)
 189 userdom_user_home_dir_filetrans_user_home_content(user_mail_t, file)
 190 # for reading .forward - maybe we need a new type for it?
 191 # also for delivering mail to maildir
 192 userdom_manage_user_home_content_dirs(mailserver_delivery)
 193 userdom_manage_user_home_content_files(mailserver_delivery)
 194 userdom_manage_user_home_content_symlinks(mailserver_delivery)
 195 userdom_manage_user_home_content_pipes(mailserver_delivery)
 196 userdom_manage_user_home_content_sockets(mailserver_delivery)
 197 userdom_user_home_dir_filetrans_user_home_content(mailserver_delivery, { dir file lnk_file fifo_file sock_file })
 198 # Read user temporary files.
 199 userdom_read_user_tmp_files(user_mail_t)
 200 userdom_dontaudit_append_user_tmp_files(user_mail_t)
 201 # cjp: this should probably be read all user tmp
 202 # files in an appropriate place for mta_user_agent
 203 userdom_read_user_tmp_files(mta_user_agent)
 204
 205 tunable_policy(`use_samba_home_dirs',`
 206         fs_manage_cifs_files(user_mail_t)
 207         fs_manage_cifs_symlinks(user_mail_t)
 208 ')
 209
 210 optional_policy(`
 211         allow user_mail_t self:capability dac_override;
 212
 213         # Read user temporary files.
 214         # postfix seems to need write access if the file handle is opened read/write
 215         userdom_rw_user_tmp_files(user_mail_t)
 216
 217         postfix_read_config(user_mail_t)
 218         postfix_list_spool(user_mail_t)
 219 ')