#DESC Exim - Mail server

#

# Author:  David Hampton <hampton@employees.org>

# From postfix.te by Russell Coker <russell@coker.com.au>

# Depends: mta.te

#

type exim_spool_t, file_type, sysadmfile;

type exim_spool_db_t, file_type, sysadmfile;

##########

# Exim daemon

##########

daemon_domain(exim, `, mta_delivery_agent, mail_server_domain, mail_server_sender, nscd_client_domain, privlog, privhome', nosysadm)

exim_common(exim);

etcdir_domain(exim)

logdir_domain(exim)

########################################

########################################

role sysadm_r types exim_t;

# Server side networking

can_network_tcp(exim_t);

allow exim_t { smtp_port_t amavisd_send_port_t }:tcp_socket name_bind;

# The exim daemon gets to listen to mail coming back from amavisd

# For identd lookups

allow exim_t inetd_child_port_t:tcp_socket name_connect;

allow exim_t self:unix_dgram_socket create_socket_perms;

# Lock file between exim processes. Exim creates a lock file in /tmp

# that doesn't transition to the exim_tmp_t domain for some reason,

# thus the allow statement.

tmp_domain(exim)

allow exim_t tmp_t:file { getattr read };

# Lock files for the actual mail delivery.  Exim wants to create a

# 'hitching post' file in the same directory as the delivery file.

# These are the additiona privileges over and above what's defined for

# an mta_delivery_agent. Additional privs for maildir mail files

allow exim_t mail_spool_t:dir remove_name;

allow exim_t mail_spool_t:file { link setattr unlink write rename };

# For access to users .forward files

allow exim_t home_dir_type:dir { getattr search };

allow exim_t self:capability { dac_read_search net_bind_service };

# Create exim spool files, update spool database

create_dir_file(exim_t, exim_spool_t)

rw_dir_file(exim_t, exim_spool_db_t)

# Start daemon/child processes

can_exec(exim_t, exim_exec_t)

allow exim_t sbin_t:dir r_dir_perms;

# Read aliases file

allow exim_t etc_aliases_t:file r_file_perms;

#

allow exim_t devpts_t:chr_file getattr;

ifdef(`crond.te', `

system_crond_entry(exim_exec_t, exim_t)

domain_auto_trans(crond_t, exim_exec_t, exim_t)

allow exim_t system_crond_tmp_t:file { getattr read append };

#logwatch

allow system_crond_t exim_log_t:file read;

')

# For squirrelmail

ifdef(`httpd.te', `

domain_auto_trans(httpd_sys_script_t, exim_exec_t, exim_t)

allow exim_t httpd_t:fd use;

allow exim_t httpd_t:process sigchld;

allow exim_t httpd_log_t:file { append getattr };

allow exim_t httpd_squirrelmail_t:file { append read };

allow exim_t httpd_t:fifo_file { read write getattr };

allow exim_t httpd_t:tcp_socket { read write };

')

########################################

########################################

##  --------------------------------------------------

##		 exim_ro, exim_ro_net

##

##  Many of the subsequent applications call exim for

##  the sole purpose of extracting configuration or

##  other information.  Lock down the permissions on

##  these instances to be pretty much read-only

##  everything.

##

##  One of the applications calls exim only to

##  determine whether an address is valid.  It does

##  this by having exim attempt to deliver an empty

##  message, without doing the actual deliver.

##  These function are aplit out here to keep all the

##  access controls on exim itself in poe part of the

##  file.

##  --------------------------------------------------

define(`exim_ro_base', `

application_domain($1)

role system_r types $1_t;

read_sysctl($1_t)

r_dir_file($1_t, etc_t)		#for nsswitch.conf

r_dir_file($1_t, var_spool_t)

r_dir_file($1_t, exim_spool_t)

allow $1_t devpts_t:chr_file { getattr read write };

allow $1_t self:capability { dac_override setgid setuid };

')

exim_ro_base(exim_ro)

dontaudit exim_ro_t self:unix_stream_socket { connect create };

exim_ro_base(exim_ro_net)

can_network(exim_ro_net_t)

general_proc_read_access(exim_ro_net_t)

read_locale(exim_ro_net_t)

allow exim_ro_net_t mail_spool_t:dir search;

allow exim_ro_net_t etc_aliases_t:file r_file_perms;

allow exim_ro_net_t self:unix_stream_socket { create connect };

##  --------------------------------------------------

##  exim_helper_base

##

##  Define the base attributes for an exim helper

##  program.

##  --------------------------------------------------

define(`exim_helper_base',`

application_domain($1)

role system_r types $1_t;

can_exec_any($1_t)

allow $1_t devpts_t:dir search;

# Needed for perl

general_domain_access($1_t)

general_proc_read_access($1_t)

allow $1_t urandom_device_t:chr_file read;

allow $1_t { devtty_t devpts_t }:chr_file { read write ioctl };

read_locale($1_t)

allow $1_t sbin_t:dir r_dir_perms;

')

##  --------------------------------------------------

##  exim_helper_script_base

##  --------------------------------------------------

define(`exim_helper_script_base',`

exim_helper_base($1)

# Needed for bash

allow $1_t { devtty_t devpts_t }:chr_file { read write getattr };

allow $1_t devpts_t:dir search;

allow $1_t fs_t:filesystem getattr;

rw_dir_create_file($1_t, tmp_t)		# Script uses a "here" document

dontaudit $1_t etc_runtime_t:file { getattr read };	# mtab

dontaudit $1_t selinux_config_t:dir { search };

dontaudit $1_t selinux_config_t:file { getattr read };	# mtab

allow $1_t var_spool_t:dir search;		# Needed to traverse to get to /var/spool/exim

')

##  --------------------------------------------------

##  exicyclog

##  --------------------------------------------------

exim_helper_script_base(exicyclog)

allow exicyclog_t self:capability { dac_override setuid setgid };

create_dir_file(exicyclog_t, exim_log_t)

allow exicyclog_t var_t:dir r_dir_perms;

allow exicyclog_t var_log_t:dir r_dir_perms;

allow exicyclog_t exim_spool_t:dir r_dir_perms;

##  --------------------------------------------------

##  exigrep

##  --------------------------------------------------

exim_helper_base(exigrep)

allow exigrep_t self:capability dac_override;

r_dir_file(exigrep_t, var_log_t)

r_dir_file(exigrep_t, exim_log_t)

##  --------------------------------------------------

##  exipick

##  --------------------------------------------------

exim_helper_base(exipick)

domain_auto_trans(exipick_t, exim_exec_t, exim_ro_t)

r_dir_file(exipick_t, var_spool_t)

r_dir_file(exipick_t, exim_spool_t)

allow exipick_t self:capability dac_override;

##  --------------------------------------------------

##  exiqgrep

##  --------------------------------------------------

exim_helper_base(exiqgrep)

domain_auto_trans(exiqgrep_t, exim_exec_t, exim_ro_t)

application_domain(exim_lock)

role system_r types exim_lock_t;

##  --------------------------------------------------

##  exiwhat

##     1) Runs exim to extract config info

##     2) Sends a signal to all running exim processes

##     3) Collects the status files they drop in the spool directory

##  --------------------------------------------------

exim_helper_script_base(exiwhat)

domain_auto_trans(exiwhat_t, exim_exec_t, exim_ro_t)

allow exiwhat_t exim_spool_t:dir { rw_dir_perms };

allow exiwhat_t exim_spool_t:file { r_file_perms unlink };

# killall

r_dir_file(exiwhat_t, exim_t)

r_dir_file(exiwhat_t, selinux_config_t)

allow exiwhat_t exim_t:process signal;

allow exiwhat_t self:capability { dac_override kill sys_nice };

dontaudit exiwhat_t file_type:dir search;

dontaudit exiwhat_t file_type:file { getattr read };

# rm

allow exiwhat_t devpts_t:chr_file ioctl;

##  --------------------------------------------------

##  exim_check_access

##     1) Runs exim to simulate mail receipt

##     2) Checks on whether the mail address is allowed from the ip address

##  --------------------------------------------------

exim_helper_script_base(exim_checkaccess)

domain_auto_trans(exim_checkaccess_t, exim_exec_t, exim_ro_net_t)

allow exim_checkaccess_t exim_spool_t:dir { r_dir_perms };

allow exim_checkaccess_t self:capability dac_override;

##  --------------------------------------------------

##  exim_helper

##  --------------------------------------------------

application_domain(exim_helper)

domain_auto_trans(exim_helper_t, exim_exec_t, exim_ro_t)

can_exec(exim_helper_t, bin_t)

role system_r types exim_helper_t;

general_domain_access(exim_helper_t)

read_locale(exim_helper_t)

allow exim_helper_t { devtty_t devpts_t }:chr_file { read write };

# Have to walk through /var/log to get to /var/log/exim

allow exim_helper_t var_t:dir r_dir_perms;

r_dir_file(exim_helper_t, exim_log_t)

##  --------------------------------------------------

##  exim database maintenance programs

##     exim_dump_db, exim_fixdb, exim_tidydb

##  --------------------------------------------------

define(`exim_db_base',`

application_domain($1)

role system_r types $1_t;

read_locale($1_t)

general_proc_read_access($1_t)

allow $1_t devpts_t:chr_file { getattr read write };

allow $1_t self:capability { dac_override setgid setuid };

allow $1_t tmp_t:dir { getattr };

r_dir_file($1_t, var_spool_t)

r_dir_file($1_t, exim_spool_t)

r_dir_file($1_t, exim_spool_db_t)

dontaudit $1_t etc_runtime_t:file { getattr read };	# mtab

')

exim_db_base(exim_db_ro)

exim_db_base(exim_db_rw)

rw_dir_file(exim_db_rw_t, exim_spool_db_t)