policy/modules/services/mta.te

   1
   2 policy_module(mta,1.4.1)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 attribute mta_user_agent;
  10 attribute mailserver_delivery;
  11 attribute mailserver_domain;
  12 attribute mailserver_sender;
  13
  14 attribute user_mail_domain;
  15
  16 type etc_aliases_t;
  17 files_type(etc_aliases_t)
  18
  19 type etc_mail_t;
  20 files_config_file(etc_mail_t)
  21
  22 type mqueue_spool_t;
  23 files_type(mqueue_spool_t)
  24
  25 type mail_spool_t;
  26 files_type(mail_spool_t)
  27
  28 type sendmail_exec_t;
  29 files_type(sendmail_exec_t)
  30
  31 mta_base_mail_template(system)
  32 role system_r types system_mail_t;
  33
  34 # cjp: need to resolve this, but require{}
  35 # does not work in the else part of the optional
  36 #ifdef(`strict_policy',`
  37 #       optional_policy(`',`
  38 #               init_system_domain(system_mail_t,sendmail_exec_t)
  39 #       ')
  40 #')
  41
  42 ########################################
  43 #
  44 # System mail local policy
  45 #
  46
  47 # newalias required this, not sure if it is needed in 'if' file
  48 allow system_mail_t self:capability { dac_override };
  49
  50 allow system_mail_t etc_mail_t:dir { getattr search };
  51 allow system_mail_t etc_mail_t:file r_file_perms;
  52
  53 kernel_read_system_state(system_mail_t)
  54 kernel_read_network_state(system_mail_t)
  55
  56 dev_read_rand(system_mail_t)
  57 dev_read_urand(system_mail_t)
  58
  59 init_use_script_ptys(system_mail_t)
  60
  61 userdom_use_sysadm_terms(system_mail_t)
  62
  63 ifdef(`targeted_policy',`
  64         typealias system_mail_t alias sysadm_mail_t;
  65
  66         allow system_mail_t mail_spool_t:dir create_dir_perms;
  67         allow system_mail_t mail_spool_t:file create_file_perms;
  68         allow system_mail_t mail_spool_t:lnk_file create_lnk_perms;
  69         allow system_mail_t mail_spool_t:fifo_file rw_file_perms;
  70
  71         allow system_mail_t mqueue_spool_t:dir create_dir_perms;
  72         allow system_mail_t mqueue_spool_t:file create_file_perms;
  73         allow system_mail_t mqueue_spool_t:lnk_file create_lnk_perms;
  74
  75         # for reading .forward - maybe we need a new type for it?
  76         # also for delivering mail to maildir
  77         userdom_manage_generic_user_home_content_dirs(mailserver_delivery)
  78         userdom_manage_generic_user_home_content_files(mailserver_delivery)
  79         userdom_manage_generic_user_home_content_symlinks(mailserver_delivery)
  80         userdom_manage_generic_user_home_content_sockets(mailserver_delivery)
  81         userdom_manage_generic_user_home_content_pipes(mailserver_delivery)
  82         userdom_generic_user_home_dir_filetrans_generic_user_home_content(mailserver_delivery,{ dir file lnk_file sock_file fifo_file })
  83
  84 # cjp: another require-in-else to resolve
  85 #       optional_policy(`',`
  86                 corecmd_exec_all_executables(system_mail_t)
  87
  88                 files_exec_etc_files(system_mail_t)
  89
  90                 libs_exec_ld_so(system_mail_t)
  91                 libs_exec_lib_files(system_mail_t)
  92 #       ')
  93 ')
  94
  95 optional_policy(`
  96         apache_read_squirrelmail_data(system_mail_t)
  97         apache_append_squirrelmail_data(system_mail_t)
  98
  99         # apache should set close-on-exec
 100         apache_dontaudit_append_log(system_mail_t)
 101         apache_dontaudit_rw_stream_sockets(system_mail_t)
 102         apache_dontaudit_rw_tcp_sockets(system_mail_t)
 103         apache_dontaudit_rw_sys_script_stream_sockets(system_mail_t)
 104 ')
 105
 106 optional_policy(`
 107         arpwatch_manage_tmp_files(system_mail_t)
 108
 109         ifdef(`hide_broken_symptoms', `
 110                 arpwatch_dontaudit_rw_packet_sockets(system_mail_t)
 111         ')
 112 ')
 113
 114 optional_policy(`
 115         cron_read_system_job_tmp_files(system_mail_t)
 116         cron_dontaudit_write_pipes(system_mail_t)
 117 ')
 118
 119 optional_policy(`
 120         cvs_read_data(system_mail_t)
 121 ')
 122
 123 optional_policy(`
 124         logrotate_read_tmp_files(system_mail_t)
 125 ')
 126
 127 optional_policy(`
 128         logwatch_read_tmp_files(system_mail_t)
 129 ')
 130
 131 optional_policy(`
 132         nagios_read_tmp_files(system_mail_t)
 133 ')
 134
 135 optional_policy(`
 136         allow system_mail_t etc_aliases_t:dir create_dir_perms;
 137         allow system_mail_t etc_aliases_t:file create_file_perms;
 138         allow system_mail_t etc_aliases_t:lnk_file create_lnk_perms;
 139         allow system_mail_t etc_aliases_t:sock_file create_file_perms;
 140         allow system_mail_t etc_aliases_t:fifo_file create_file_perms;
 141         files_etc_filetrans(system_mail_t,etc_aliases_t,{ file lnk_file sock_file fifo_file })
 142
 143         domain_use_interactive_fds(system_mail_t)
 144
 145         # postfix needs this for newaliases
 146         files_getattr_tmp_dirs(system_mail_t)
 147
 148         postfix_exec_master(system_mail_t)
 149         postfix_read_config(system_mail_t)
 150         postfix_search_spool(system_mail_t)
 151
 152         ifdef(`distro_redhat',`
 153                 # compatability for old default main.cf
 154                 postfix_config_filetrans(system_mail_t,etc_aliases_t,{ dir file lnk_file sock_file fifo_file })
 155         ')
 156
 157         optional_policy(`
 158                 cron_rw_tcp_sockets(system_mail_t)
 159         ')
 160 ')
 161
 162 optional_policy(`
 163         qmail_domtrans_inject(system_mail_t)
 164 ')
 165
 166 optional_policy(`
 167         sxid_read_log(system_mail_t)
 168 ')
 169
 170 optional_policy(`
 171         userdom_dontaudit_use_unpriv_users_ptys(system_mail_t)
 172
 173         optional_policy(`
 174                 cron_dontaudit_append_system_job_tmp_files(system_mail_t)
 175         ')
 176 ')
 177
 178 optional_policy(`
 179         smartmon_read_tmp_files(system_mail_t)
 180 ')
 181
 182 # should break this up among sections:
 183
 184 optional_policy(`
 185         # why is mail delivered to a directory of type arpwatch_data_t?
 186         arpwatch_search_data(mailserver_delivery)
 187         arpwatch_manage_tmp_files(mta_user_agent)
 188         ifdef(`hide_broken_symptoms', `
 189                 arpwatch_dontaudit_rw_packet_sockets(mta_user_agent)
 190         ')
 191         optional_policy(`
 192                 cron_read_system_job_tmp_files(mta_user_agent)
 193         ')
 194 ')