Chris PeBenito 799a0b
Chris PeBenito 799a0b
policy_module(mailman,1.0)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
########################################
Chris PeBenito 799a0b
#
Chris PeBenito 799a0b
# Declarations
Chris PeBenito 799a0b
#
Chris PeBenito 799a0b
Chris PeBenito 799a0b
mailman_domain_template(cgi)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
type mailman_data_t;
Chris PeBenito 799a0b
files_type(mailman_data_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
type mailman_archive_t;
Chris PeBenito 799a0b
files_type(mailman_archive_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
type mailman_log_t;
Chris PeBenito 799a0b
logging_log_file(mailman_log_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
type mailman_lock_t;
Chris PeBenito 799a0b
files_lock_file(mailman_lock_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
mailman_domain_template(mail)
Chris PeBenito 799a0b
init_daemon_domain(mailman_mail_t,mailman_mail_exec_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
mailman_domain_template(queue)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
########################################
Chris PeBenito 799a0b
#
Chris PeBenito 799a0b
# Mailman CGI local policy
Chris PeBenito 799a0b
#
Chris PeBenito 799a0b
Chris PeBenito 799a0b
# cjp: the template invocation for queue should be
Chris PeBenito 799a0b
# in the below optional policy; however, there are no
Chris PeBenito 799a0b
# optionals for file contexts yet, so it is promoted
Chris PeBenito 799a0b
# to global scope until such facilities exist.
Chris PeBenito 799a0b
Chris PeBenito 799a0b
optional_policy(`apache.te',`
Chris PeBenito 799a0b
	allow mailman_cgi_t mailman_archive_t:dir create_dir_perms;
Chris PeBenito 799a0b
	allow mailman_cgi_t mailman_archive_t:lnk_file create_lnk_perms;
Chris PeBenito 799a0b
	allow mailman_cgi_t mailman_archive_t:file create_file_perms;
Chris PeBenito 799a0b
Chris PeBenito 799a0b
	kernel_tcp_recvfrom(mailman_cgi_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
	term_use_controlling_term(mailman_cgi_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
	files_search_spool(mailman_cgi_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
	mta_tcp_connect_all_mailservers(mailman_cgi_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
	apache_sigchld(mailman_cgi_t)
Chris PeBenito 799a0b
	apache_use_fd(mailman_cgi_t)
Chris PeBenito 799a0b
	apache_dontaudit_append_log(mailman_cgi_t)
Chris PeBenito 799a0b
')
Chris PeBenito 799a0b
Chris PeBenito 799a0b
########################################
Chris PeBenito 799a0b
#
Chris PeBenito 799a0b
# Mailman mail local policy
Chris PeBenito 799a0b
#
Chris PeBenito 799a0b
Chris PeBenito 799a0b
allow mailman_mail_t self:unix_dgram_socket create_socket_perms;
Chris PeBenito 799a0b
Chris PeBenito 799a0b
mta_dontaudit_rw_delivery_tcp_socket(mailman_mail_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
ifdef(`TODO',`
Chris PeBenito 799a0b
optional_policy(`qmail.te', `
Chris PeBenito 799a0b
	allow mailman_mail_t qmail_spool_t:file { read ioctl getattr };
Chris PeBenito 799a0b
	# do we really need this?
Chris PeBenito 799a0b
	allow mailman_mail_t qmail_lspawn_t:fifo_file write;
Chris PeBenito 799a0b
')
Chris PeBenito 799a0b
')
Chris PeBenito 799a0b
Chris PeBenito 799a0b
########################################
Chris PeBenito 799a0b
#
Chris PeBenito 799a0b
# Mailman queue local policy
Chris PeBenito 799a0b
#
Chris PeBenito 799a0b
Chris PeBenito 799a0b
allow mailman_queue_t self:capability { setgid setuid };
Chris PeBenito 799a0b
allow mailman_queue_t self:process signal;
Chris PeBenito 799a0b
allow mailman_queue_t self:fifo_file rw_file_perms;
Chris PeBenito 799a0b
allow mailman_queue_t self:unix_dgram_socket create_socket_perms;
Chris PeBenito 799a0b
allow mailman_queue_t self:netlink_route_socket r_netlink_socket_perms;
Chris PeBenito 799a0b
Chris PeBenito 799a0b
allow mailman_queue_t mailman_archive_t:dir create_dir_perms;
Chris PeBenito 799a0b
allow mailman_queue_t mailman_archive_t:file create_file_perms;
Chris PeBenito 799a0b
allow mailman_queue_t mailman_archive_t:lnk_file create_lnk_perms;
Chris PeBenito 799a0b
Chris PeBenito 799a0b
kernel_read_proc_symlinks(mailman_queue_t)
Chris PeBenito 799a0b
kernel_tcp_recvfrom(mailman_queue_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
auth_domtrans_chk_passwd(mailman_queue_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
files_dontaudit_search_pids(mailman_queue_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
# for su
Chris PeBenito 799a0b
seutil_dontaudit_search_config(mailman_queue_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
# some of the following could probably be changed to dontaudit, someone who
Chris PeBenito 799a0b
# knows mailman well should test this out and send the changes
Chris PeBenito 799a0b
userdom_search_sysadm_home_dir(mailman_queue_t)
Chris PeBenito 799a0b
userdom_getattr_sysadm_home_dir(mailman_queue_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
mta_tcp_connect_all_mailservers(mailman_queue_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
su_exec(mailman_queue_t)
Chris PeBenito 799a0b
Chris PeBenito 799a0b
optional_policy(`cron.te',`
Chris PeBenito 799a0b
	cron_system_entry(mailman_queue_t,mailman_queue_exec_t)
Chris PeBenito 799a0b
')
Chris PeBenito 799a0b
Chris PeBenito 799a0b
optional_policy(`nscd.te',`
Chris PeBenito 799a0b
	nscd_use_socket(mailman_queue_t)
Chris PeBenito 799a0b
')