Allow user_mail_t to read mail home file

diff --git a/policy/modules/apps/sandbox.te b/policy/modules/apps/sandbox.te
index b16a2f8c6cfc69fc11ae7a052c19c63fccc2bf13..5e75113d5ea65755d593903482de3818eece1132 100644 (file)
--- a/policy/modules/apps/sandbox.te
+++ b/policy/modules/apps/sandbox.te
@@ -351,6 +351,8 @@ optional_policy(`
 #
 typeattribute sandbox_web_client_t sandbox_web_type;
 
+auth_use_nsswitch(sandbox_web_client_t)
+
 allow sandbox_web_type self:capability { setuid setgid };
 allow sandbox_web_type self:netlink_audit_socket nlmsg_relay;
 dontaudit sandbox_web_type self:process setrlimit;
@@ -407,8 +409,6 @@ fs_dontaudit_getattr_all_fs(sandbox_web_type)
 
 storage_dontaudit_getattr_fixed_disk_dev(sandbox_web_type)
 
-auth_use_nsswitch(sandbox_web_type)
-
 dbus_system_bus_client(sandbox_web_type)
 dbus_read_config(sandbox_web_type)
 selinux_get_fs_mount(sandbox_web_type)
@@ -478,6 +478,8 @@ corenet_udp_sendrecv_all_ports(sandbox_net_client_t)
 corenet_tcp_connect_all_ports(sandbox_net_client_t)
 corenet_sendrecv_all_client_packets(sandbox_net_client_t)
 
+auth_use_nsswitch(sandbox_net_client_t)
+
 optional_policy(`
        mozilla_dontaudit_rw_user_home_files(sandbox_x_t)
        mozilla_dontaudit_rw_user_home_files(sandbox_xserver_t)

diff --git a/policy/modules/services/mta.te b/policy/modules/services/mta.te
index c84e80fdc9f50985f1ef73ce57f4d4483ed17377..65fd01fae3214baea87455e67784fbdab66aee3c 100644 (file)
--- a/policy/modules/services/mta.te
+++ b/policy/modules/services/mta.te
@@ -326,6 +326,7 @@ allow user_mail_domain self:fifo_file rw_fifo_file_perms;
 allow user_mail_domain mta_exec_type:file entrypoint;
 
 append_files_pattern(user_mail_domain, mail_home_t, mail_home_t)
+read_files_pattern(user_mail_domain, mail_home_t, mail_home_t)
 
 read_files_pattern(user_mail_domain, etc_aliases_t, etc_aliases_t)
 

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index ab9a14e53593fb3c5333059f93002d1bc7e05634..52afc25a1883ef81632297d4af7ebb2191478e76 100644 (file)
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -5061,7 +5061,7 @@ interface(`userdom_filetrans_home_content',`
        userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
        userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
 
-       optional_policy(`
-               gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
-       ')
+       #optional_policy(`
+       #       gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
+       #')
 ')