Chris PeBenito 17de1b
## <summary>Postfix email server</summary>
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Postfix stub interface.  No access allowed.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito f7eaee
## <param name="domain" unused="true">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito f7eaee
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`postfix_stub',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type postfix_master_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Creates types and rules for a basic
Chris PeBenito 17de1b
##	postfix process domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="prefix">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Prefix for the domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
template(`postfix_domain_template',`
Chris PeBenito 17de1b
	type postfix_$1_t;
Chris PeBenito 17de1b
	type postfix_$1_exec_t;
Chris PeBenito 17de1b
	domain_type(postfix_$1_t)
Chris PeBenito 0bfccd
	domain_entry_file(postfix_$1_t, postfix_$1_exec_t)
Chris PeBenito 17de1b
	role system_r types postfix_$1_t;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit postfix_$1_t self:capability sys_tty_config;
Chris PeBenito 17de1b
	allow postfix_$1_t self:process { signal_perms setpgid };
Chris PeBenito 17de1b
	allow postfix_$1_t self:unix_dgram_socket create_socket_perms;
Chris PeBenito 17de1b
	allow postfix_$1_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito 17de1b
	allow postfix_$1_t self:unix_stream_socket connectto;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow postfix_master_t postfix_$1_t:process signal;
Chris PeBenito 134a79
	#https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=244456
Chris PeBenito 134a79
	allow postfix_$1_t postfix_master_t:file read;
Chris PeBenito 17de1b
Chris PeBenito c0868a
	allow postfix_$1_t postfix_etc_t:dir list_dir_perms;
Chris PeBenito 0bfccd
	read_files_pattern(postfix_$1_t, postfix_etc_t, postfix_etc_t)
Chris PeBenito d9e4cb
	read_lnk_files_pattern(postfix_$1_t, postfix_etc_t, postfix_etc_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	can_exec(postfix_$1_t, postfix_$1_exec_t)
Chris PeBenito 17de1b
Chris PeBenito ef659a
	allow postfix_$1_t postfix_exec_t:file { mmap_file_perms lock ioctl };
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow postfix_$1_t postfix_master_t:process sigchld;
Chris PeBenito 17de1b
Chris PeBenito c0868a
	allow postfix_$1_t postfix_spool_t:dir list_dir_perms;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow postfix_$1_t postfix_var_run_t:file manage_file_perms;
Chris PeBenito 0bfccd
	files_pid_filetrans(postfix_$1_t, postfix_var_run_t, file)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	kernel_read_system_state(postfix_$1_t)
Chris PeBenito 17de1b
	kernel_read_network_state(postfix_$1_t)
Chris PeBenito 17de1b
	kernel_read_all_sysctls(postfix_$1_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dev_read_sysfs(postfix_$1_t)
Chris PeBenito 17de1b
	dev_read_rand(postfix_$1_t)
Chris PeBenito 17de1b
	dev_read_urand(postfix_$1_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	fs_search_auto_mountpoints(postfix_$1_t)
Chris PeBenito 17de1b
	fs_getattr_xattr_fs(postfix_$1_t)
Chris PeBenito 134a79
	fs_rw_anon_inodefs_files(postfix_$1_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	term_dontaudit_use_console(postfix_$1_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	corecmd_exec_shell(postfix_$1_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_read_etc_files(postfix_$1_t)
Chris PeBenito 17de1b
	files_read_etc_runtime_files(postfix_$1_t)
Dan Walsh 3eaa99
	files_read_usr_files(postfix_$1_t)
Chris PeBenito 17de1b
	files_read_usr_symlinks(postfix_$1_t)
Chris PeBenito 17de1b
	files_search_spool(postfix_$1_t)
Chris PeBenito 17de1b
	files_getattr_tmp_dirs(postfix_$1_t)
Chris PeBenito d9e4cb
	files_search_all_mountpoints(postfix_$1_t)
Chris PeBenito 17de1b
Chris PeBenito a5f5eb
	init_dontaudit_use_fds(postfix_$1_t)
Chris PeBenito 17de1b
	init_sigchld(postfix_$1_t)
Chris PeBenito 17de1b
Chris PeBenito c0cf6e
	auth_use_nsswitch(postfix_$1_t)
Chris PeBenito c0cf6e
Chris PeBenito 17de1b
	logging_send_syslog_msg(postfix_$1_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	miscfiles_read_localization(postfix_$1_t)
Chris PeBenito 17de1b
	miscfiles_read_certs(postfix_$1_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	userdom_dontaudit_use_unpriv_user_fds(postfix_$1_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	optional_policy(`
Chris PeBenito 17de1b
		udev_read_db(postfix_$1_t)
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Creates a postfix server process domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="prefix">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Prefix of the domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
template(`postfix_server_domain_template',`
Chris PeBenito 17de1b
	postfix_domain_template($1)
Chris PeBenito 17de1b
Chris PeBenito d9e4cb
	type postfix_$1_tmp_t;
Chris PeBenito d9e4cb
	files_tmp_file(postfix_$1_tmp_t)
Chris PeBenito d9e4cb
Chris PeBenito 17de1b
	allow postfix_$1_t self:capability { setuid setgid dac_override };
Chris PeBenito 17de1b
	allow postfix_$1_t postfix_master_t:unix_stream_socket { connectto rw_stream_socket_perms };
Chris PeBenito 17de1b
	allow postfix_$1_t self:tcp_socket create_socket_perms;
Chris PeBenito 17de1b
	allow postfix_$1_t self:udp_socket create_socket_perms;
Chris PeBenito 17de1b
Chris PeBenito d9e4cb
	manage_dirs_pattern(postfix_$1_t, postfix_$1_tmp_t, postfix_$1_tmp_t)
Chris PeBenito d9e4cb
	manage_files_pattern(postfix_$1_t, postfix_$1_tmp_t, postfix_$1_tmp_t)
Chris PeBenito d9e4cb
	files_tmp_filetrans(postfix_$1_t, postfix_$1_tmp_t, { file dir })
Chris PeBenito d9e4cb
Chris PeBenito c0868a
	domtrans_pattern(postfix_master_t, postfix_$1_exec_t, postfix_$1_t)
Chris PeBenito 17de1b
Chris PeBenito 190066
	corenet_all_recvfrom_unlabeled(postfix_$1_t)
Chris PeBenito 190066
	corenet_all_recvfrom_netlabel(postfix_$1_t)
Chris PeBenito 668b30
	corenet_tcp_sendrecv_generic_if(postfix_$1_t)
Chris PeBenito 668b30
	corenet_udp_sendrecv_generic_if(postfix_$1_t)
Chris PeBenito c12621
	corenet_tcp_sendrecv_generic_node(postfix_$1_t)
Chris PeBenito c12621
	corenet_udp_sendrecv_generic_node(postfix_$1_t)
Chris PeBenito 17de1b
	corenet_tcp_sendrecv_all_ports(postfix_$1_t)
Chris PeBenito 17de1b
	corenet_udp_sendrecv_all_ports(postfix_$1_t)
Chris PeBenito c12621
	corenet_tcp_bind_generic_node(postfix_$1_t)
Chris PeBenito c12621
	corenet_udp_bind_generic_node(postfix_$1_t)
Chris PeBenito 17de1b
	corenet_tcp_connect_all_ports(postfix_$1_t)
Chris PeBenito 17de1b
	corenet_sendrecv_all_client_packets(postfix_$1_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Creates a process domain for programs
Chris PeBenito 17de1b
##	that are ran by users.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="prefix">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Prefix of the domain.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
template(`postfix_user_domain_template',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		attribute postfix_user_domains, postfix_user_domtrans;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	postfix_domain_template($1)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	typeattribute postfix_$1_t postfix_user_domains;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	allow postfix_$1_t self:capability dac_override;
Chris PeBenito 17de1b
Chris PeBenito c0868a
	domtrans_pattern(postfix_user_domtrans, postfix_$1_exec_t, postfix_$1_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	domain_use_interactive_fds(postfix_$1_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Read postfix configuration files.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito bbcd3c
## <rolecap/>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`postfix_read_config',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type postfix_etc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito d9e4cb
	read_files_pattern($1, postfix_etc_t, postfix_etc_t)
Chris PeBenito d9e4cb
	read_lnk_files_pattern($1, postfix_etc_t, postfix_etc_t)
Chris PeBenito 17de1b
	files_search_etc($1)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Create files with the specified type in
Chris PeBenito 17de1b
##	the postfix configuration directories.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="private type">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The type of the object to be created.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="object">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	The object class of the object being created.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`postfix_config_filetrans',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type postfix_etc_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	files_search_etc($1)
Chris PeBenito 0bfccd
	filetrans_pattern($1, postfix_etc_t, $2, $3)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Do not audit attempts to read and
Chris PeBenito 17de1b
##	write postfix local delivery
Chris PeBenito 17de1b
##	TCP sockets.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain to not audit.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`postfix_dontaudit_rw_local_tcp_sockets',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type postfix_local_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 postfix_local_t:tcp_socket { read write };
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito d9e4cb
##	Allow read/write postfix local pipes
Chris PeBenito d9e4cb
##	TCP sockets.
Chris PeBenito d9e4cb
## </summary>
Chris PeBenito d9e4cb
## <param name="domain">
Chris PeBenito d9e4cb
##	<summary>
Chris PeBenito d9e4cb
##	Domain allowed access.
Chris PeBenito d9e4cb
##	</summary>
Chris PeBenito d9e4cb
## </param>
Chris PeBenito d9e4cb
#
Chris PeBenito d9e4cb
interface(`postfix_rw_local_pipes',`
Chris PeBenito d9e4cb
	gen_require(`
Chris PeBenito d9e4cb
		type postfix_local_t;
Chris PeBenito d9e4cb
	')
Chris PeBenito d9e4cb
Chris PeBenito d9e4cb
	allow $1 postfix_local_t:fifo_file rw_fifo_file_perms;
Chris PeBenito d9e4cb
')
Chris PeBenito d9e4cb
Chris PeBenito d9e4cb
########################################
Chris PeBenito d9e4cb
## <summary>
Chris PeBenito 134a79
##	Allow domain to read postfix local process state
Chris PeBenito 134a79
## </summary>
Chris PeBenito 134a79
## <param name="domain">
Chris PeBenito 134a79
##	<summary>
Dominick Grift 288845
##	Domain allowed access.
Chris PeBenito 134a79
##	</summary>
Chris PeBenito 134a79
## </param>
Chris PeBenito 134a79
#
Chris PeBenito 134a79
interface(`postfix_read_local_state',`
Chris PeBenito 134a79
	gen_require(`
Chris PeBenito 134a79
		type postfix_local_t;
Chris PeBenito 134a79
	')
Chris PeBenito 134a79
Chris PeBenito 0bfccd
	read_files_pattern($1, postfix_local_t, postfix_local_t)
Chris PeBenito 134a79
')
Chris PeBenito 134a79
Chris PeBenito 134a79
########################################
Chris PeBenito 134a79
## <summary>
Chris PeBenito 134a79
##	Allow domain to read postfix master process state
Chris PeBenito 134a79
## </summary>
Chris PeBenito 134a79
## <param name="domain">
Chris PeBenito 134a79
##	<summary>
Dominick Grift 288845
##	Domain allowed access.
Chris PeBenito 134a79
##	</summary>
Chris PeBenito 134a79
## </param>
Chris PeBenito 134a79
#
Chris PeBenito 134a79
interface(`postfix_read_master_state',`
Chris PeBenito 134a79
	gen_require(`
Chris PeBenito 134a79
		type postfix_master_t;
Chris PeBenito 134a79
	')
Chris PeBenito 134a79
Chris PeBenito 0bfccd
	read_files_pattern($1, postfix_master_t, postfix_master_t)
Chris PeBenito 134a79
')
Chris PeBenito 134a79
Chris PeBenito 134a79
########################################
Chris PeBenito 134a79
## <summary>
Chris PeBenito 17de1b
##	Do not audit attempts to use
Chris PeBenito 17de1b
##	postfix master process file
Chris PeBenito 17de1b
##	file descriptors.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain to not audit.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`postfix_dontaudit_use_fds',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type postfix_master_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	dontaudit $1 postfix_master_t:fd use;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute postfix_map in the postfix_map domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift 288845
##	Domain allowed to transition.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`postfix_domtrans_map',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type postfix_map_t, postfix_map_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 0bfccd
	domtrans_pattern($1, postfix_map_exec_t, postfix_map_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute postfix_map in the postfix_map domain, and
Chris PeBenito 17de1b
##	allow the specified role the postfix_map domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift 288845
##	Domain allowed to transition.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
## <param name="role">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito a7ee7f
##	Role allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito bbcd3c
## <rolecap/>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`postfix_run_map',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type postfix_map_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	postfix_domtrans_map($1)
Chris PeBenito 17de1b
	role $2 types postfix_map_t;
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute the master postfix program in the
Chris PeBenito 17de1b
##	postfix_master domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift 288845
##	Domain allowed to transition.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`postfix_domtrans_master',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type postfix_master_t, postfix_master_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 0bfccd
	domtrans_pattern($1, postfix_master_exec_t, postfix_master_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Dan Walsh 3eaa99
Dan Walsh 3eaa99
########################################
Dan Walsh 3eaa99
## <summary>
Dan Walsh 3eaa99
##	Execute the master postfix in the postfix master domain.
Dan Walsh 3eaa99
## </summary>
Dan Walsh 3eaa99
## <param name="domain">
Dan Walsh 3eaa99
##	<summary>
Dan Walsh 3eaa99
##	Domain allowed access.
Dan Walsh 3eaa99
##	</summary>
Dan Walsh 3eaa99
## </param>
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
interface(`postfix_initrc_domtrans', `
Dan Walsh 3eaa99
	gen_require(`
Dan Walsh 3eaa99
		type postfix_initrc_exec_t;
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	init_labeled_script_domtrans($1, postfix_initrc_exec_t)
Dan Walsh 3eaa99
')
Dan Walsh 3eaa99
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	Execute the master postfix program in the
Chris PeBenito 17de1b
##	caller domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`postfix_exec_master',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type postfix_master_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 3f67f7
	can_exec($1, postfix_master_exec_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito d9e4cb
#######################################
Chris PeBenito d9e4cb
## <summary>
Chris PeBenito d9e4cb
##	Connect to postfix master process using a unix domain stream socket.
Chris PeBenito d9e4cb
## </summary>
Chris PeBenito d9e4cb
## <param name="domain">
Chris PeBenito d9e4cb
##	<summary>
Chris PeBenito d9e4cb
##	Domain allowed access.
Chris PeBenito d9e4cb
##	</summary>
Chris PeBenito d9e4cb
## </param>
Chris PeBenito d9e4cb
## <rolecap/>
Chris PeBenito d9e4cb
#
Chris PeBenito d9e4cb
interface(`postfix_stream_connect_master',`
Chris PeBenito d9e4cb
	gen_require(`
Chris PeBenito d9e4cb
		type postfix_master_t, postfix_public_t;
Chris PeBenito d9e4cb
	')
Chris PeBenito d9e4cb
Chris PeBenito d9e4cb
	stream_connect_pattern($1, postfix_public_t, postfix_public_t, postfix_master_t)
Chris PeBenito d9e4cb
')
Chris PeBenito d9e4cb
Chris PeBenito d9e4cb
########################################
Chris PeBenito d9e4cb
## <summary>
Chris PeBenito d9e4cb
##	Execute the master postdrop in the
Chris PeBenito d9e4cb
##	postfix_postdrop domain.
Chris PeBenito d9e4cb
## </summary>
Chris PeBenito d9e4cb
## <param name="domain">
Chris PeBenito d9e4cb
##	<summary>
Dominick Grift 288845
##	Domain allowed to transition.
Chris PeBenito d9e4cb
##	</summary>
Chris PeBenito d9e4cb
## </param>
Chris PeBenito d9e4cb
#
Chris PeBenito d9e4cb
interface(`postfix_domtrans_postdrop',`
Chris PeBenito d9e4cb
	gen_require(`
Chris PeBenito d9e4cb
		type postfix_postdrop_t, postfix_postdrop_exec_t;
Chris PeBenito d9e4cb
	')
Chris PeBenito d9e4cb
Chris PeBenito d9e4cb
	domtrans_pattern($1, postfix_postdrop_exec_t, postfix_postdrop_t)
Chris PeBenito d9e4cb
')
Chris PeBenito d9e4cb
Chris PeBenito d9e4cb
########################################
Chris PeBenito d9e4cb
## <summary>
Chris PeBenito d9e4cb
##	Execute the master postqueue in the
Chris PeBenito d9e4cb
##	postfix_postqueue domain.
Chris PeBenito d9e4cb
## </summary>
Chris PeBenito d9e4cb
## <param name="domain">
Chris PeBenito d9e4cb
##	<summary>
Dominick Grift 288845
##	Domain allowed to transition.
Chris PeBenito d9e4cb
##	</summary>
Chris PeBenito d9e4cb
## </param>
Chris PeBenito d9e4cb
#
Chris PeBenito d9e4cb
interface(`postfix_domtrans_postqueue',`
Chris PeBenito d9e4cb
	gen_require(`
Chris PeBenito d9e4cb
		type postfix_postqueue_t, postfix_postqueue_exec_t;
Chris PeBenito d9e4cb
	')
Chris PeBenito d9e4cb
Chris PeBenito d9e4cb
	domtrans_pattern($1, postfix_postqueue_exec_t, postfix_postqueue_t)
Chris PeBenito d9e4cb
')
Chris PeBenito d9e4cb
Chris PeBenito d9e4cb
#######################################
Chris PeBenito d9e4cb
## <summary>
Chris PeBenito d9e4cb
##	Execute the master postqueue in the caller domain.
Chris PeBenito d9e4cb
## </summary>
Chris PeBenito d9e4cb
## <param name="domain">
Chris PeBenito d9e4cb
##	<summary>
Chris PeBenito d9e4cb
##	Domain allowed access.
Chris PeBenito d9e4cb
##	</summary>
Chris PeBenito d9e4cb
## </param>
Chris PeBenito d9e4cb
#
Chris PeBenito d9e4cb
interface(`posftix_exec_postqueue',`
Chris PeBenito d9e4cb
	gen_require(`
Chris PeBenito d9e4cb
		type postfix_postqueue_exec_t;
Chris PeBenito d9e4cb
	')
Chris PeBenito d9e4cb
Chris PeBenito d9e4cb
	can_exec($1, postfix_postqueue_exec_t)
Chris PeBenito d9e4cb
')
Chris PeBenito d9e4cb
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 134a79
##	Create a named socket in a postfix private directory.
Chris PeBenito 134a79
## </summary>
Chris PeBenito 134a79
## <param name="domain">
Chris PeBenito 134a79
##	<summary>
Chris PeBenito 134a79
##	Domain allowed access.
Chris PeBenito 134a79
##	</summary>
Chris PeBenito 134a79
## </param>
Chris PeBenito 134a79
#
Chris PeBenito d9e4cb
interface(`postfix_create_private_sockets',`
Chris PeBenito 134a79
	gen_require(`
Chris PeBenito 134a79
		type postfix_private_t;
Chris PeBenito 134a79
	')
Chris PeBenito 134a79
Chris PeBenito 134a79
	allow $1 postfix_private_t:dir list_dir_perms;
Chris PeBenito 0bfccd
	create_sock_files_pattern($1, postfix_private_t, postfix_private_t)
Chris PeBenito 134a79
')
Chris PeBenito 134a79
Chris PeBenito 134a79
########################################
Chris PeBenito 134a79
## <summary>
Chris PeBenito d9e4cb
##	manage named socket in a postfix private directory.
Chris PeBenito d9e4cb
## </summary>
Chris PeBenito d9e4cb
## <param name="domain">
Chris PeBenito d9e4cb
##	<summary>
Chris PeBenito d9e4cb
##	Domain allowed access.
Chris PeBenito d9e4cb
##	</summary>
Chris PeBenito d9e4cb
## </param>
Chris PeBenito d9e4cb
#
Chris PeBenito d9e4cb
interface(`postfix_manage_private_sockets',`
Chris PeBenito d9e4cb
	gen_require(`
Chris PeBenito d9e4cb
		type postfix_private_t;
Chris PeBenito d9e4cb
	')
Chris PeBenito d9e4cb
Chris PeBenito d9e4cb
	allow $1 postfix_private_t:dir list_dir_perms;
Chris PeBenito d9e4cb
	manage_sock_files_pattern($1, postfix_private_t, postfix_private_t)
Chris PeBenito d9e4cb
')
Chris PeBenito d9e4cb
Chris PeBenito d9e4cb
########################################
Chris PeBenito d9e4cb
## <summary>
Chris PeBenito 17de1b
##	Execute the master postfix program in the
Chris PeBenito 17de1b
##	postfix_master domain.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Dominick Grift 288845
##	Domain allowed to transition.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`postfix_domtrans_smtp',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		type postfix_smtp_t, postfix_smtp_exec_t;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 0bfccd
	domtrans_pattern($1, postfix_smtp_exec_t, postfix_smtp_t)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Dan Walsh 3eaa99
##	Getattr postfix mail spool files.
Dan Walsh 3eaa99
## </summary>
Dan Walsh 3eaa99
## <param name="domain">
Dan Walsh 3eaa99
##	<summary>
Dan Walsh 3eaa99
##	Domain allowed access.
Dan Walsh 3eaa99
##	</summary>
Dan Walsh 3eaa99
## </param>
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
interface(`postfix_getattr_spool_files',`
Dan Walsh 3eaa99
	gen_require(`
Dan Walsh 3eaa99
		attribute postfix_spool_type;
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	files_search_spool($1)
Dan Walsh 3eaa99
	getattr_files_pattern($1, postfix_spool_type, postfix_spool_type)
Dan Walsh 3eaa99
')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
########################################
Dan Walsh 3eaa99
## <summary>
Chris PeBenito 17de1b
##	Search postfix mail spool directories.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`postfix_search_spool',`
Chris PeBenito 17de1b
	gen_require(`
Dan Walsh 3eaa99
		attribute postfix_spool_type;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Dan Walsh 3eaa99
	allow $1 postfix_spool_type:dir search_dir_perms;
Chris PeBenito 17de1b
	files_search_spool($1)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 17de1b
##	List postfix mail spool directories.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`postfix_list_spool',`
Chris PeBenito 17de1b
	gen_require(`
Dan Walsh 3eaa99
		attribute postfix_spool_type;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Dan Walsh 3eaa99
	allow $1 postfix_spool_type:dir list_dir_perms;
Chris PeBenito 17de1b
	files_search_spool($1)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
## <summary>
Chris PeBenito 134a79
##	Read postfix mail spool files.
Chris PeBenito 134a79
## </summary>
Chris PeBenito 134a79
## <param name="domain">
Chris PeBenito 134a79
##	<summary>
Chris PeBenito 134a79
##	Domain allowed access.
Chris PeBenito 134a79
##	</summary>
Chris PeBenito 134a79
## </param>
Chris PeBenito 134a79
#
Chris PeBenito 134a79
interface(`postfix_read_spool_files',`
Chris PeBenito 134a79
	gen_require(`
Dan Walsh 3eaa99
		attribute postfix_spool_type;
Chris PeBenito 134a79
	')
Chris PeBenito 134a79
Chris PeBenito 134a79
	files_search_spool($1)
Dan Walsh 3eaa99
	read_files_pattern($1, postfix_spool_type, postfix_spool_type)
Chris PeBenito 134a79
')
Chris PeBenito 134a79
Chris PeBenito 134a79
########################################
Chris PeBenito 134a79
## <summary>
Chris PeBenito 9ff89c
##	Create, read, write, and delete postfix mail spool files.
Chris PeBenito 9ff89c
## </summary>
Chris PeBenito 9ff89c
## <param name="domain">
Chris PeBenito 9ff89c
##	<summary>
Chris PeBenito 9ff89c
##	Domain allowed access.
Chris PeBenito 9ff89c
##	</summary>
Chris PeBenito 9ff89c
## </param>
Chris PeBenito 9ff89c
#
Chris PeBenito 9ff89c
interface(`postfix_manage_spool_files',`
Chris PeBenito 9ff89c
	gen_require(`
Dan Walsh 3eaa99
		attribute postfix_spool_type;
Chris PeBenito 9ff89c
	')
Chris PeBenito 9ff89c
Chris PeBenito 9ff89c
	files_search_spool($1)
Dan Walsh 3eaa99
	manage_files_pattern($1, postfix_spool_type, postfix_spool_type)
Chris PeBenito 9ff89c
')
Chris PeBenito 9ff89c
Chris PeBenito 9ff89c
########################################
Chris PeBenito 9ff89c
## <summary>
Chris PeBenito 17de1b
##	Execute postfix user mail programs
Chris PeBenito 17de1b
##	in their respective domains.
Chris PeBenito 17de1b
## </summary>
Chris PeBenito 17de1b
## <param name="domain">
Chris PeBenito 17de1b
##	<summary>
Chris PeBenito 17de1b
##	Domain allowed access.
Chris PeBenito 17de1b
##	</summary>
Chris PeBenito 17de1b
## </param>
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
interface(`postfix_domtrans_user_mail_handler',`
Chris PeBenito 17de1b
	gen_require(`
Chris PeBenito 17de1b
		attribute postfix_user_domtrans;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
	typeattribute $1 postfix_user_domtrans;
Chris PeBenito 17de1b
')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
########################################
Dan Walsh 3eaa99
## <summary>
Dan Walsh 3eaa99
##	All of the rules required to administrate
Dan Walsh 3eaa99
##	an postfix environment.
Dan Walsh 3eaa99
## </summary>
Dan Walsh 3eaa99
## <param name="domain">
Dan Walsh 3eaa99
##	<summary>
Dan Walsh 3eaa99
##	Domain allowed access.
Dan Walsh 3eaa99
##	</summary>
Dan Walsh 3eaa99
## </param>
Dan Walsh 3eaa99
## <param name="role">
Dan Walsh 3eaa99
##	<summary>
Dan Walsh 3eaa99
##	Role allowed access.
Dan Walsh 3eaa99
##	</summary>
Dan Walsh 3eaa99
## </param>
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
interface(`postfix_admin', `
Dan Walsh 3eaa99
	gen_require(`
Dan Walsh 3eaa99
		type postfix_bounce_t, postfix_cleanup_t, postfix_local_t; 
Dan Walsh 3eaa99
		type postfix_master_t, postfix_pickup_t, postfix_qmgr_t; 
Dan Walsh 3eaa99
		type postfix_smtpd_t;
Dan Walsh 3eaa99
Dan Walsh 3eaa99
		attribute postfix_spool_type;
Dan Walsh 3eaa99
Dan Walsh 3eaa99
		type postfix_initrc_exec_t, postfix_data_t, postfix_etc_t;
Dan Walsh 3eaa99
		type postfix_var_run_t;
Dan Walsh 3eaa99
Dan Walsh 3eaa99
		type postfix_map_tmp_t, postfix_prng_t, postfix_public_t;
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	allow $1 postfix_bounce_t:process { ptrace signal_perms getattr };
Dan Walsh 3eaa99
	read_files_pattern($1, postfix_bounce_t, postfix_bounce_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	allow $1 postfix_cleanup_t:process { ptrace signal_perms getattr };
Dan Walsh 3eaa99
	read_files_pattern($1, postfix_cleanup_t, postfix_cleanup_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	allow $1 postfix_local_t:process { ptrace signal_perms getattr };
Dan Walsh 3eaa99
	read_files_pattern($1, postfix_local_t, postfix_local_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	allow $1 postfix_master_t:process { ptrace signal_perms getattr };
Dan Walsh 3eaa99
	read_files_pattern($1, postfix_master_t, postfix_master_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	allow $1 postfix_pickup_t:process { ptrace signal_perms getattr };
Dan Walsh 3eaa99
	read_files_pattern($1, postfix_pickup_t, postfix_pickup_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	allow $1 postfix_qmgr_t:process { ptrace signal_perms getattr };
Dan Walsh 3eaa99
	read_files_pattern($1, postfix_qmgr_t, postfix_qmgr_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	allow $1 postfix_smtpd_t:process { ptrace signal_perms getattr };
Dan Walsh 3eaa99
	read_files_pattern($1, postfix_smtpd_t, postfix_smtpd_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	postfix_run_map($1,$2)
Dan Walsh 3eaa99
	postfix_run_postdrop($1,$2)
Dan Walsh 3eaa99
		
Dan Walsh 3eaa99
	postfix_initrc_domtrans($1)
Dan Walsh 3eaa99
	domain_system_change_exemption($1)
Dan Walsh 3eaa99
	role_transition $2 postfix_initrc_exec_t system_r;
Dan Walsh 3eaa99
	allow $2 system_r;
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	admin_pattern($1, postfix_data_t) 
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	files_list_etc($1)
Dan Walsh 3eaa99
	admin_pattern($1, postfix_etc_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	files_search_spool($1)
Dan Walsh 3eaa99
	admin_pattern($1,postfix_spool_type)	
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	admin_pattern($1, postfix_var_run_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	files_search_tmp($1)
Dan Walsh 3eaa99
	admin_pattern($1, postfix_map_tmp_t)
Dan Walsh 3eaa99
	
Dan Walsh 3eaa99
	admin_pattern($1, postfix_prng_t)
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	admin_pattern($1, postfix_public_t)
Dan Walsh 3eaa99
')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
########################################
Dan Walsh 3eaa99
## <summary>
Dan Walsh 3eaa99
##	Execute the master postdrop in the
Dan Walsh 3eaa99
##	postfix_postdrop domain.
Dan Walsh 3eaa99
## </summary>
Dan Walsh 3eaa99
## <param name="domain">
Dan Walsh 3eaa99
##	<summary>
Dan Walsh 3eaa99
##	Domain allowed access.
Dan Walsh 3eaa99
##	</summary>
Dan Walsh 3eaa99
## </param>
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
interface(`postfix_run_postdrop',`
Dan Walsh 3eaa99
	gen_require(`
Dan Walsh 3eaa99
		type postfix_postdrop_t;
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	postfix_domtrans_postdrop($1)
Dan Walsh 3eaa99
	role $2 types postfix_postdrop_t;
Dan Walsh 3eaa99
')
Dan Walsh 3eaa99