Add named filetrans for mta content, remove unconfined_sendmail_t

diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index 2d9baa1ac58cf162cac6593ce0ce1f85bbc09b93..303ada316285f05f6d6b754d86e29d261b22d73d 100644 (file)
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -259,6 +259,8 @@ optional_policy(`
 
 optional_policy(`
        mta_role(sysadm_r, sysadm_t)
+       mta_filetrans_home_content(sysadm_t)
+       mta_filetrans_admin_home_content(sysadm_t)
 ')
 
 optional_policy(`

diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
index 7d48821a3fc044be7d4aa38f490b771f468a8084..024753f8c08edbaa385ec97003cfe4102fc84479 100644 (file)
--- a/policy/modules/roles/unconfineduser.te
+++ b/policy/modules/roles/unconfineduser.te
@@ -370,6 +370,10 @@ optional_policy(`
        ')
 ')
 
+optional_policy(`
+       mta_filetrans_named_content(unconfined_t)
+')
+
 optional_policy(`
        ncftool_run(unconfined_t, unconfined_r)
 ')
@@ -421,10 +425,6 @@ optional_policy(`
        samba_run_smbcontrol(unconfined_t, unconfined_r)
 ')
 
-optional_policy(`
-       sendmail_run_unconfined(unconfined_t, unconfined_r)
-')
-
 optional_policy(`
        sysnet_run_dhcpc(unconfined_t, unconfined_r)
        sysnet_dbus_chat_dhcpc(unconfined_t)

diff --git a/policy/modules/services/mta.if b/policy/modules/services/mta.if
index 3d7edf0d6c619fd3fbaea8785975fbd85a4093e6..daa9dbee63421dc5b4c4571fe6edaf5aef6e2b20 100644 (file)
--- a/policy/modules/services/mta.if
+++ b/policy/modules/services/mta.if
@@ -570,7 +570,7 @@ interface(`mta_etc_filetrans_aliases',`
                type etc_aliases_t;
        ')
 
-       files_etc_filetrans($1, etc_aliases_t, file)
+       files_etc_filetrans($1, etc_aliases_t, file, $2)
 ')
 
 ########################################
@@ -984,3 +984,65 @@ interface(`mta_read_home',`
                userdom_search_admin_dir($1)
        ')
 ')
+
+########################################
+## <summary>
+##     create mail content in the  in the /root directory
+##     with an correct label.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`mta_filetrans_admin_home_content',`
+       gen_require(`
+               type mail_home_t;
+       ')
+
+       userdom_admin_home_dir_filetrans($1, mail_home_t, file, dead.letter)
+       userdom_admin_home_dir_filetrans($1, mail_home_t, file, .forward)
+')
+
+########################################
+## <summary>
+##     Transition to mta named content
+## </summary>
+## <param name="domain">
+##     <summary>
+##      Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`mta_filetrans_home_content',`
+       gen_require(`
+               type mail_home_t;
+       ')
+
+       userdom_user_home_dir_filetrans($1, mail_home_t, file, dead.letter)
+       userdom_user_home_dir_filetrans($1, mail_home_t, file, .forward)
+')
+
+########################################
+## <summary>
+##     Transition to apache named content
+## </summary>
+## <param name="domain">
+##     <summary>
+##      Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`mta_filetrans_named_content',`
+       gen_require(`
+               type etc_aliases_t;
+               type etc_mail_t;
+       ')
+
+       filetrans_pattern($1, etc_mail_t, etc_aliases_t, { dir file )}
+       mta_etc_filetrans_aliases($1, aliases)
+       mta_etc_filetrans_aliases($1, aliases.db)
+       mta_filetrans_home_content($1)
+       mta_filetrans_admin_home_content($1)
+')

diff --git a/policy/modules/services/sendmail.te b/policy/modules/services/sendmail.te
index b6781d5df088717781e3ff7f7d44427e47b6e78a..c3cf42a45a741382794b6898afe207ad1beec64d 100644 (file)
--- a/policy/modules/services/sendmail.te
+++ b/policy/modules/services/sendmail.te
@@ -22,10 +22,6 @@ mta_mailserver_sender(sendmail_t)
 type sendmail_initrc_exec_t;
 init_script_file(sendmail_initrc_exec_t)
 
-type unconfined_sendmail_t;
-application_domain(unconfined_sendmail_t, sendmail_exec_t)
-role system_r types unconfined_sendmail_t;
-
 ########################################
 #
 # Sendmail local policy
@@ -185,14 +181,3 @@ optional_policy(`
 optional_policy(`
        uucp_domtrans_uux(sendmail_t)
 ')
-
-########################################
-#
-# Unconfined sendmail local policy
-# Allow unconfined domain to run newalias and have transitions work
-#
-
-optional_policy(`
-       mta_etc_filetrans_aliases(unconfined_sendmail_t)
-       unconfined_domain_noaudit(unconfined_sendmail_t)
-')

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 5ea0ea40f054eee28c9e4bbbc91df3e540b3c146..fd286479aaffb6d86e4f5a81ece90b8061d43a49 100644 (file)
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -763,6 +763,7 @@ template(`userdom_common_user_template',`
        optional_policy(`
                mta_rw_spool($1_usertype)
                mta_manage_queue($1_usertype)
+               mta_filetrans_home_content($1_usertype)
        ')
 
        optional_policy(`