policy/modules/services/spamassassin.te

   1 policy_module(spamassassin, 2.4.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 ## <desc>
   9 ##      <p>
  10 ##      Allow user spamassassin clients to use the network.
  11 ##      </p>
  12 ## </desc>
  13 gen_tunable(spamassassin_can_network, false)
  14
  15 ## <desc>
  16 ##      <p>
  17 ##      Allow spamd to read/write user home directories.
  18 ##      </p>
  19 ## </desc>
  20 gen_tunable(spamd_enable_home_dirs, true)
  21
  22 ifdef(`distro_redhat',`
  23         # spamassassin client executable
  24         type spamc_t;
  25         type spamc_exec_t;
  26         application_domain(spamc_t, spamc_exec_t)
  27         role system_r types spamc_t;
  28
  29         type spamd_etc_t;
  30         files_config_file(spamd_etc_t)
  31
  32         typealias spamc_exec_t  alias spamassassin_exec_t;
  33         typealias spamc_t alias spamassassin_t;
  34
  35         type spamc_home_t;
  36         userdom_user_home_content(spamc_home_t)
  37         typealias spamc_home_t alias { spamassassin_home_t user_spamassassin_home_t staff_spamassassin_home_t sysadm_spamassassin_home_t };
  38         typealias spamc_home_t alias { auditadm_spamassassin_home_t secadm_spamassassin_home_t };
  39         typealias spamc_home_t alias { user_spamc_home_t staff_spamc_home_t sysadm_spamc_home_t };
  40         typealias spamc_home_t alias { auditadm_spamc_home_t secadm_spamc_home_t };
  41
  42         type spamc_tmp_t;
  43         files_tmp_file(spamc_tmp_t)
  44         typealias spamc_tmp_t alias spamassassin_tmp_t;
  45         typealias spamc_tmp_t alias { user_spamassassin_tmp_t staff_spamassassin_tmp_t sysadm_spamassassin_tmp_t };
  46         typealias spamc_tmp_t alias { auditadm_spamassassin_tmp_t secadm_spamassassin_tmp_t };
  47
  48         typealias spamc_tmp_t alias { user_spamc_tmp_t staff_spamc_tmp_t sysadm_spamc_tmp_t };
  49         typealias spamc_tmp_t alias { auditadm_spamc_tmp_t secadm_spamc_tmp_t };
  50 ',`
  51         type spamassassin_t;
  52         type spamassassin_exec_t;
  53         typealias spamassassin_t alias { user_spamassassin_t staff_spamassassin_t sysadm_spamassassin_t };
  54         typealias spamassassin_t alias { auditadm_spamassassin_t secadm_spamassassin_t };
  55         application_domain(spamassassin_t, spamassassin_exec_t)
  56         ubac_constrained(spamassassin_t)
  57
  58         type spamassassin_home_t;
  59         typealias spamassassin_home_t alias { user_spamassassin_home_t staff_spamassassin_home_t sysadm_spamassassin_home_t };
  60         typealias spamassassin_home_t alias { auditadm_spamassassin_home_t secadm_spamassassin_home_t };
  61         userdom_user_home_content(spamassassin_home_t)
  62
  63         type spamassassin_tmp_t;
  64         typealias spamassassin_tmp_t alias { user_spamassassin_tmp_t staff_spamassassin_tmp_t sysadm_spamassassin_tmp_t };
  65         typealias spamassassin_tmp_t alias { auditadm_spamassassin_tmp_t secadm_spamassassin_tmp_t };
  66         files_tmp_file(spamassassin_tmp_t)
  67         ubac_constrained(spamassassin_tmp_t)
  68
  69         type spamc_t;
  70         type spamc_exec_t;
  71         typealias spamc_t alias { user_spamc_t staff_spamc_t sysadm_spamc_t };
  72         typealias spamc_t alias { auditadm_spamc_t secadm_spamc_t };
  73         application_domain(spamc_t, spamc_exec_t)
  74         ubac_constrained(spamc_t)
  75
  76         type spamc_tmp_t;
  77         typealias spamc_tmp_t alias { user_spamc_tmp_t staff_spamc_tmp_t sysadm_spamc_tmp_t };
  78         typealias spamc_tmp_t alias { auditadm_spamc_tmp_t secadm_spamc_tmp_t };
  79         files_tmp_file(spamc_tmp_t)
  80         ubac_constrained(spamc_tmp_t)
  81 ')
  82
  83 type spamd_update_t;
  84 type spamd_update_exec_t;
  85 application_domain(spamd_update_t, spamd_update_exec_t)
  86 cron_system_entry(spamd_update_t, spamd_update_exec_t)
  87 role system_r types spamd_update_t;
  88
  89 type spamd_t;
  90 type spamd_exec_t;
  91 init_daemon_domain(spamd_t, spamd_exec_t)
  92
  93 type spamd_compiled_t;
  94 files_type(spamd_compiled_t)
  95
  96 type spamd_initrc_exec_t;
  97 init_script_file(spamd_initrc_exec_t)
  98
  99 type spamd_log_t;
 100 logging_log_file(spamd_log_t)
 101
 102 type spamd_spool_t;
 103 files_spool_file(spamd_spool_t)
 104
 105 type spamd_tmp_t;
 106 files_tmp_file(spamd_tmp_t)
 107
 108 # var/lib files
 109 type spamd_var_lib_t;
 110 files_type(spamd_var_lib_t)
 111
 112 type spamd_var_run_t;
 113 files_pid_file(spamd_var_run_t)
 114
 115 ##############################
 116 #
 117 # Standalone program local policy
 118 #
 119
 120 allow spamassassin_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 121 allow spamassassin_t self:fd use;
 122 allow spamassassin_t self:fifo_file rw_fifo_file_perms;
 123 allow spamassassin_t self:sock_file read_sock_file_perms;
 124 allow spamassassin_t self:unix_dgram_socket create_socket_perms;
 125 allow spamassassin_t self:unix_stream_socket create_stream_socket_perms;
 126 allow spamassassin_t self:unix_dgram_socket sendto;
 127 allow spamassassin_t self:unix_stream_socket connectto;
 128 allow spamassassin_t self:shm create_shm_perms;
 129 allow spamassassin_t self:sem create_sem_perms;
 130 allow spamassassin_t self:msgq create_msgq_perms;
 131 allow spamassassin_t self:msg { send receive };
 132
 133 manage_dirs_pattern(spamassassin_t, spamassassin_home_t, spamassassin_home_t)
 134 manage_files_pattern(spamassassin_t, spamassassin_home_t, spamassassin_home_t)
 135 manage_lnk_files_pattern(spamassassin_t, spamassassin_home_t, spamassassin_home_t)
 136 manage_fifo_files_pattern(spamassassin_t, spamassassin_home_t, spamassassin_home_t)
 137 manage_sock_files_pattern(spamassassin_t, spamassassin_home_t, spamassassin_home_t)
 138 userdom_user_home_dir_filetrans(spamassassin_t, spamassassin_home_t, { dir file lnk_file sock_file fifo_file })
 139
 140 manage_dirs_pattern(spamassassin_t, spamassassin_tmp_t, spamassassin_tmp_t)
 141 manage_files_pattern(spamassassin_t, spamassassin_tmp_t, spamassassin_tmp_t)
 142 files_tmp_filetrans(spamassassin_t, spamassassin_tmp_t, { file dir })
 143
 144 manage_dirs_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
 145 manage_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
 146 manage_lnk_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
 147 manage_fifo_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
 148 manage_sock_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
 149 userdom_user_home_dir_filetrans(spamd_t, spamassassin_home_t, { dir file lnk_file sock_file fifo_file })
 150 userdom_home_manager(spamassassin_t)
 151
 152 kernel_read_kernel_sysctls(spamassassin_t)
 153
 154 dev_read_urand(spamassassin_t)
 155
 156 fs_search_auto_mountpoints(spamassassin_t)
 157 fs_getattr_all_fs(spamassassin_t)
 158
 159 # this should probably be removed
 160 corecmd_list_bin(spamassassin_t)
 161 corecmd_read_bin_symlinks(spamassassin_t)
 162 corecmd_read_bin_files(spamassassin_t)
 163 corecmd_read_bin_pipes(spamassassin_t)
 164 corecmd_read_bin_sockets(spamassassin_t)
 165
 166 domain_use_interactive_fds(spamassassin_t)
 167
 168 files_read_etc_files(spamassassin_t)
 169 files_read_etc_runtime_files(spamassassin_t)
 170 files_list_home(spamassassin_t)
 171 files_read_usr_files(spamassassin_t)
 172 files_dontaudit_search_var(spamassassin_t)
 173
 174 logging_send_syslog_msg(spamassassin_t)
 175
 176 miscfiles_read_localization(spamassassin_t)
 177
 178 # cjp: this could probably be removed
 179 seutil_read_config(spamassassin_t)
 180
 181 sysnet_dns_name_resolve(spamassassin_t)
 182
 183 # set tunable if you have spamassassin do DNS lookups
 184 tunable_policy(`spamassassin_can_network',`
 185         allow spamassassin_t self:tcp_socket create_stream_socket_perms;
 186         allow spamassassin_t self:udp_socket create_socket_perms;
 187
 188         corenet_all_recvfrom_unlabeled(spamassassin_t)
 189         corenet_all_recvfrom_netlabel(spamassassin_t)
 190         corenet_tcp_sendrecv_generic_if(spamassassin_t)
 191         corenet_udp_sendrecv_generic_if(spamassassin_t)
 192         corenet_tcp_sendrecv_generic_node(spamassassin_t)
 193         corenet_udp_sendrecv_generic_node(spamassassin_t)
 194         corenet_tcp_sendrecv_all_ports(spamassassin_t)
 195         corenet_udp_sendrecv_all_ports(spamassassin_t)
 196         corenet_tcp_connect_all_ports(spamassassin_t)
 197         corenet_sendrecv_all_client_packets(spamassassin_t)
 198         corenet_udp_bind_generic_node(spamassassin_t)
 199         corenet_udp_bind_generic_port(spamassassin_t)
 200         corenet_dontaudit_udp_bind_all_ports(spamassassin_t)
 201
 202         sysnet_read_config(spamassassin_t)
 203 ')
 204
 205 tunable_policy(`spamd_enable_home_dirs',`
 206         userdom_manage_user_home_content_dirs(spamd_t)
 207         userdom_manage_user_home_content_files(spamd_t)
 208         userdom_manage_user_home_content_symlinks(spamd_t)
 209 ')
 210
 211 optional_policy(`
 212         # Write pid file and socket in ~/.evolution/cache/tmp
 213         evolution_home_filetrans(spamd_t, spamd_tmp_t, { file sock_file })
 214 ')
 215
 216 optional_policy(`
 217         tunable_policy(`spamassassin_can_network && allow_ypbind',`
 218                 nis_use_ypbind_uncond(spamassassin_t)
 219         ')
 220 ')
 221
 222 optional_policy(`
 223         mta_read_config(spamassassin_t)
 224         sendmail_stub(spamassassin_t)
 225         sendmail_dontaudit_rw_unix_stream_sockets(spamassassin_t)
 226         sendmail_dontaudit_rw_tcp_sockets(spamassassin_t)
 227 ')
 228
 229 ########################################
 230 #
 231 # Client local policy
 232 #
 233
 234 allow spamc_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 235 allow spamc_t self:fd use;
 236 allow spamc_t self:fifo_file rw_fifo_file_perms;
 237 allow spamc_t self:sock_file read_sock_file_perms;
 238 allow spamc_t self:shm create_shm_perms;
 239 allow spamc_t self:sem create_sem_perms;
 240 allow spamc_t self:msgq create_msgq_perms;
 241 allow spamc_t self:msg { send receive };
 242 allow spamc_t self:unix_dgram_socket create_socket_perms;
 243 allow spamc_t self:unix_stream_socket create_stream_socket_perms;
 244 allow spamc_t self:unix_dgram_socket sendto;
 245 allow spamc_t self:unix_stream_socket connectto;
 246 allow spamc_t self:tcp_socket create_stream_socket_perms;
 247 allow spamc_t self:udp_socket create_socket_perms;
 248
 249 can_exec(spamc_t, spamc_exec_t)
 250
 251 manage_dirs_pattern(spamc_t, spamc_tmp_t, spamc_tmp_t)
 252 manage_files_pattern(spamc_t, spamc_tmp_t, spamc_tmp_t)
 253 files_tmp_filetrans(spamc_t, spamc_tmp_t, { file dir })
 254
 255 manage_dirs_pattern(spamc_t, spamc_home_t, spamc_home_t)
 256 manage_files_pattern(spamc_t, spamc_home_t, spamc_home_t)
 257 manage_lnk_files_pattern(spamc_t, spamc_home_t, spamc_home_t)
 258 manage_fifo_files_pattern(spamc_t, spamc_home_t, spamc_home_t)
 259 manage_sock_files_pattern(spamc_t, spamc_home_t, spamc_home_t)
 260 userdom_user_home_dir_filetrans(spamc_t, spamc_home_t, { dir file lnk_file sock_file fifo_file })
 261 userdom_append_user_home_content_files(spamc_t)
 262
 263 list_dirs_pattern(spamc_t, spamd_var_lib_t, spamd_var_lib_t)
 264 read_files_pattern(spamc_t, spamd_var_lib_t, spamd_var_lib_t)
 265
 266 # Allow connecting to a local spamd
 267 allow spamc_t spamd_t:unix_stream_socket connectto;
 268 allow spamc_t spamd_tmp_t:sock_file rw_sock_file_perms;
 269 spamd_stream_connect(spamc_t)
 270
 271 kernel_read_kernel_sysctls(spamc_t)
 272 kernel_read_system_state(spamc_t)
 273
 274 corecmd_exec_bin(spamc_t)
 275
 276 corenet_all_recvfrom_unlabeled(spamc_t)
 277 corenet_all_recvfrom_netlabel(spamc_t)
 278 corenet_tcp_sendrecv_generic_if(spamc_t)
 279 corenet_udp_sendrecv_generic_if(spamc_t)
 280 corenet_tcp_sendrecv_generic_node(spamc_t)
 281 corenet_udp_sendrecv_generic_node(spamc_t)
 282 corenet_tcp_sendrecv_all_ports(spamc_t)
 283 corenet_udp_sendrecv_all_ports(spamc_t)
 284 corenet_tcp_connect_all_ports(spamc_t)
 285 corenet_sendrecv_all_client_packets(spamc_t)
 286 corenet_tcp_connect_spamd_port(spamc_t)
 287
 288 fs_search_auto_mountpoints(spamc_t)
 289
 290 # cjp: these should probably be removed:
 291 corecmd_list_bin(spamc_t)
 292 corecmd_read_bin_symlinks(spamc_t)
 293 corecmd_read_bin_files(spamc_t)
 294 corecmd_read_bin_pipes(spamc_t)
 295 corecmd_read_bin_sockets(spamc_t)
 296
 297 domain_use_interactive_fds(spamc_t)
 298
 299 files_read_etc_files(spamc_t)
 300 files_read_etc_runtime_files(spamc_t)
 301 files_read_usr_files(spamc_t)
 302 files_dontaudit_search_var(spamc_t)
 303 # cjp: this may be removable:
 304 files_list_home(spamc_t)
 305 files_list_var_lib(spamc_t)
 306
 307 fs_search_auto_mountpoints(spamc_t)
 308
 309 logging_send_syslog_msg(spamc_t)
 310
 311 auth_use_nsswitch(spamc_t)
 312
 313 miscfiles_read_localization(spamc_t)
 314
 315 # cjp: this should probably be removed:
 316 seutil_read_config(spamc_t)
 317
 318 sysnet_read_config(spamc_t)
 319
 320 userdom_home_manager(spamc_t)
 321
 322 optional_policy(`
 323         abrt_stream_connect(spamc_t)
 324 ')
 325
 326 optional_policy(`
 327         # Allow connection to spamd socket above
 328         evolution_stream_connect(spamc_t)
 329 ')
 330
 331 optional_policy(`
 332         milter_manage_spamass_state(spamc_t)
 333 ')
 334
 335 optional_policy(`
 336         postfix_domtrans_postdrop(spamc_t)
 337         postfix_search_spool(spamc_t)
 338         postfix_rw_local_pipes(spamc_t)
 339         postfix_rw_master_pipes(spamc_t)
 340 ')
 341
 342 optional_policy(`
 343         mta_send_mail(spamc_t)
 344         mta_read_config(spamc_t)
 345         mta_read_queue(spamc_t)
 346         sendmail_stub(spamc_t)
 347         sendmail_rw_pipes(spamc_t)
 348         sendmail_dontaudit_rw_tcp_sockets(spamc_t)
 349 ')
 350
 351 ########################################
 352 #
 353 # Server local policy
 354 #
 355
 356 # Spamassassin, when run as root and using per-user config files,
 357 # setuids to the user running spamc.  Comment this if you are not
 358 # using this ability.
 359
 360 allow spamd_t self:capability { kill setuid setgid dac_override sys_tty_config };
 361 dontaudit spamd_t self:capability sys_tty_config;
 362 allow spamd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 363 allow spamd_t self:fd use;
 364 allow spamd_t self:fifo_file rw_fifo_file_perms;
 365 allow spamd_t self:sock_file read_sock_file_perms;
 366 allow spamd_t self:shm create_shm_perms;
 367 allow spamd_t self:sem create_sem_perms;
 368 allow spamd_t self:msgq create_msgq_perms;
 369 allow spamd_t self:msg { send receive };
 370 allow spamd_t self:unix_dgram_socket create_socket_perms;
 371 allow spamd_t self:unix_stream_socket create_stream_socket_perms;
 372 allow spamd_t self:unix_dgram_socket sendto;
 373 allow spamd_t self:unix_stream_socket connectto;
 374 allow spamd_t self:tcp_socket create_stream_socket_perms;
 375 allow spamd_t self:udp_socket create_socket_perms;
 376
 377 can_exec(spamd_t, spamd_compiled_t)
 378 manage_dirs_pattern(spamd_t, spamd_compiled_t, spamd_compiled_t)
 379 manage_files_pattern(spamd_t, spamd_compiled_t, spamd_compiled_t)
 380
 381 manage_files_pattern(spamd_t, spamd_log_t, spamd_log_t)
 382 logging_log_filetrans(spamd_t, spamd_log_t, file)
 383
 384 manage_dirs_pattern(spamd_t, spamd_spool_t, spamd_spool_t)
 385 manage_files_pattern(spamd_t, spamd_spool_t, spamd_spool_t)
 386 manage_sock_files_pattern(spamd_t, spamd_spool_t, spamd_spool_t)
 387 files_spool_filetrans(spamd_t, spamd_spool_t, { file dir })
 388
 389 manage_dirs_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t)
 390 manage_files_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t)
 391 files_tmp_filetrans(spamd_t, spamd_tmp_t, { file dir })
 392
 393 # var/lib files for spamd
 394 allow spamd_t spamd_var_lib_t:dir list_dir_perms;
 395 manage_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t)
 396 manage_lnk_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t)
 397
 398 manage_dirs_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
 399 manage_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
 400 manage_sock_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
 401 files_pid_filetrans(spamd_t, spamd_var_run_t, { file dir })
 402
 403 can_exec(spamd_t, spamd_exec_t)
 404
 405 kernel_read_all_sysctls(spamd_t)
 406 kernel_read_system_state(spamd_t)
 407
 408 corenet_all_recvfrom_unlabeled(spamd_t)
 409 corenet_all_recvfrom_netlabel(spamd_t)
 410 corenet_tcp_sendrecv_generic_if(spamd_t)
 411 corenet_udp_sendrecv_generic_if(spamd_t)
 412 corenet_tcp_sendrecv_generic_node(spamd_t)
 413 corenet_udp_sendrecv_generic_node(spamd_t)
 414 corenet_tcp_sendrecv_all_ports(spamd_t)
 415 corenet_udp_sendrecv_all_ports(spamd_t)
 416 corenet_tcp_bind_generic_node(spamd_t)
 417 corenet_tcp_bind_spamd_port(spamd_t)
 418 corenet_tcp_connect_razor_port(spamd_t)
 419 corenet_tcp_connect_smtp_port(spamd_t)
 420 corenet_sendrecv_razor_client_packets(spamd_t)
 421 corenet_sendrecv_spamd_server_packets(spamd_t)
 422 # spamassassin 3.1 needs this for its
 423 # DnsResolver.pm module which binds to
 424 # random ports >= 1024.
 425 corenet_udp_bind_generic_node(spamd_t)
 426 corenet_udp_bind_generic_port(spamd_t)
 427 corenet_udp_bind_imaze_port(spamd_t)
 428 corenet_dontaudit_udp_bind_all_ports(spamd_t)
 429 corenet_sendrecv_imaze_server_packets(spamd_t)
 430 corenet_sendrecv_generic_server_packets(spamd_t)
 431
 432 dev_read_sysfs(spamd_t)
 433 dev_read_urand(spamd_t)
 434
 435 fs_getattr_all_fs(spamd_t)
 436 fs_search_auto_mountpoints(spamd_t)
 437
 438 auth_dontaudit_read_shadow(spamd_t)
 439
 440 corecmd_exec_bin(spamd_t)
 441
 442 domain_use_interactive_fds(spamd_t)
 443
 444 files_read_usr_files(spamd_t)
 445 files_read_etc_files(spamd_t)
 446 files_read_etc_runtime_files(spamd_t)
 447 # /var/lib/spamassin
 448 files_read_var_lib_files(spamd_t)
 449
 450 init_dontaudit_rw_utmp(spamd_t)
 451
 452 auth_use_nsswitch(spamd_t)
 453
 454 logging_send_syslog_msg(spamd_t)
 455
 456 miscfiles_read_localization(spamd_t)
 457
 458 userdom_use_unpriv_users_fds(spamd_t)
 459 userdom_search_user_home_dirs(spamd_t)
 460 userdom_home_manager(spamd_t)
 461
 462 optional_policy(`
 463         clamav_stream_connect(spamd_t)
 464 ')
 465
 466 optional_policy(`
 467         exim_manage_spool_dirs(spamd_t)
 468         exim_manage_spool_files(spamd_t)
 469 ')
 470
 471 optional_policy(`
 472         amavis_manage_lib_files(spamd_t)
 473 ')
 474
 475 optional_policy(`
 476         cron_system_entry(spamd_t, spamd_exec_t)
 477 ')
 478
 479 optional_policy(`
 480         daemontools_service_domain(spamd_t, spamd_exec_t)
 481 ')
 482
 483 optional_policy(`
 484         dcc_domtrans_cdcc(spamd_t)
 485         dcc_domtrans_client(spamd_t)
 486         dcc_signal_client(spamd_t)
 487         dcc_stream_connect_dccifd(spamd_t)
 488 ')
 489
 490 optional_policy(`
 491         milter_manage_spamass_state(spamd_t)
 492 ')
 493
 494 optional_policy(`
 495         mysql_tcp_connect(spamd_t)
 496         mysql_search_db(spamd_t)
 497         mysql_stream_connect(spamd_t)
 498 ')
 499
 500 optional_policy(`
 501         postfix_read_config(spamd_t)
 502 ')
 503
 504 optional_policy(`
 505         postgresql_tcp_connect(spamd_t)
 506         postgresql_stream_connect(spamd_t)
 507 ')
 508
 509 optional_policy(`
 510         pyzor_domtrans(spamd_t)
 511         pyzor_signal(spamd_t)
 512 ')
 513
 514 optional_policy(`
 515         razor_domtrans(spamd_t)
 516         razor_read_lib_files(spamd_t)
 517         tunable_policy(`spamd_enable_home_dirs',`
 518                 razor_manage_user_home_files(spamd_t)
 519         ')
 520 ')
 521
 522 optional_policy(`
 523         seutil_sigchld_newrole(spamd_t)
 524 ')
 525
 526 optional_policy(`
 527         mta_send_mail(spamd_t)
 528         sendmail_stub(spamd_t)
 529         mta_read_config(spamd_t)
 530 ')
 531
 532 optional_policy(`
 533         udev_read_db(spamd_t)
 534 ')
 535
 536 ########################################
 537 #
 538 # spamd_update local policy
 539 #
 540
 541 allow spamd_update_t self:fifo_file manage_fifo_file_perms;
 542 allow spamd_update_t self:unix_stream_socket create_stream_socket_perms;
 543 dontaudit spamd_update_t self:capability dac_override;
 544
 545 manage_dirs_pattern(spamd_update_t, spamd_tmp_t, spamd_tmp_t)
 546 manage_files_pattern(spamd_update_t, spamd_tmp_t, spamd_tmp_t)
 547 files_tmp_filetrans(spamd_update_t, spamd_tmp_t, { file dir })
 548
 549 allow spamd_update_t spamd_var_lib_t:dir list_dir_perms;
 550 manage_files_pattern(spamd_update_t, spamd_var_lib_t, spamd_var_lib_t)
 551 manage_lnk_files_pattern(spamd_update_t, spamd_var_lib_t, spamd_var_lib_t)
 552
 553 allow spamd_update_t spamd_tmp_t:file read_file_perms;
 554
 555 kernel_read_system_state(spamd_update_t)
 556
 557 # for updating rules
 558 corenet_tcp_connect_http_port(spamd_update_t)
 559
 560 corecmd_exec_bin(spamd_update_t)
 561 corecmd_exec_shell(spamd_update_t)
 562
 563 dev_read_urand(spamd_update_t)
 564
 565 domain_use_interactive_fds(spamd_update_t)
 566
 567 files_read_etc_files(spamd_update_t)
 568 files_read_usr_files(spamd_update_t)
 569
 570 auth_use_nsswitch(spamd_update_t)
 571 auth_dontaudit_read_shadow(spamd_update_t)
 572
 573 miscfiles_read_localization(spamd_update_t)
 574
 575 mta_read_config(spamd_update_t)
 576
 577 userdom_use_inherited_user_ptys(spamd_update_t)
 578
 579 optional_policy(`
 580         gpg_domtrans(spamd_update_t)
 581 ')
 582