Chris PeBenito 6b9383
Chris PeBenito b6cc2f
policy_module(mta,1.3.4)
Chris PeBenito 6b9383
Chris PeBenito 075c4f
########################################
Chris PeBenito 075c4f
#
Chris PeBenito 075c4f
# Declarations
Chris PeBenito 075c4f
#
Chris PeBenito 075c4f
Chris PeBenito 246839
attribute mta_user_agent;
Chris PeBenito 246839
attribute mailserver_delivery;
Chris PeBenito 246839
attribute mailserver_domain;
Chris PeBenito 246839
attribute mailserver_sender;
Chris PeBenito 246839
Chris PeBenito 04926d
attribute user_mail_domain;
Chris PeBenito 04926d
Chris PeBenito 6b9383
type etc_aliases_t;
Chris PeBenito 8fd367
files_type(etc_aliases_t)
Chris PeBenito 6b9383
Chris PeBenito 6b9383
type etc_mail_t;
Chris PeBenito 9bbc75
files_config_file(etc_mail_t)
Chris PeBenito 6b9383
Chris PeBenito 6b9383
type mqueue_spool_t;
Chris PeBenito 8fd367
files_type(mqueue_spool_t)
Chris PeBenito 6b9383
Chris PeBenito 6b9383
type mail_spool_t;
Chris PeBenito 8fd367
files_type(mail_spool_t)
Chris PeBenito 075c4f
Chris PeBenito 075c4f
type sendmail_exec_t;
Chris PeBenito 8fd367
files_type(sendmail_exec_t)
Chris PeBenito 075c4f
Chris PeBenito 08cd98
mta_base_mail_template(system)
Chris PeBenito 075c4f
role system_r types system_mail_t;
Chris PeBenito 075c4f
Chris PeBenito 12ae75
# cjp: need to resolve this, but require{}
Chris PeBenito 12ae75
# does not work in the else part of the optional
Chris PeBenito 08cd98
#ifdef(`strict_policy',`
Chris PeBenito bb7170
#	optional_policy(`',`
Chris PeBenito 12ae75
#		init_system_domain(system_mail_t,sendmail_exec_t)
Chris PeBenito 12ae75
#	')
Chris PeBenito 12ae75
#')
Chris PeBenito 7bba9d
Chris PeBenito 075c4f
########################################
Chris PeBenito 075c4f
#
Chris PeBenito 075c4f
# System mail local policy
Chris PeBenito 075c4f
#
Chris PeBenito 075c4f
Chris PeBenito 8cf671
# newalias required this, not sure if it is needed in 'if' file
Chris PeBenito 8cf671
allow system_mail_t self:capability { dac_override };
Chris PeBenito 8cf671
Don Miner f13da8
allow system_mail_t etc_mail_t:dir { getattr search };
Chris PeBenito e8d0a6
allow system_mail_t etc_mail_t:file r_file_perms;
Chris PeBenito e8d0a6
Chris PeBenito 075c4f
kernel_read_system_state(system_mail_t)
Chris PeBenito 075c4f
kernel_read_network_state(system_mail_t)
Chris PeBenito 075c4f
Chris PeBenito 98a8ea
dev_read_rand(system_mail_t)
Karl MacMillan f0c985
dev_read_urand(system_mail_t)
Chris PeBenito 075c4f
Chris PeBenito 93727e
fs_read_eventpollfs(system_mail_t)
Chris PeBenito 93727e
Chris PeBenito 1815ba
init_use_script_ptys(system_mail_t)
Chris PeBenito 075c4f
Chris PeBenito 246839
userdom_use_sysadm_terms(system_mail_t)
Chris PeBenito 246839
Chris PeBenito 246839
ifdef(`targeted_policy',`
Chris PeBenito fe9d17
	typealias system_mail_t alias sysadm_mail_t;
Chris PeBenito fe9d17
Chris PeBenito 246839
	allow system_mail_t mail_spool_t:dir create_dir_perms;
Chris PeBenito 246839
	allow system_mail_t mail_spool_t:file create_file_perms;
Chris PeBenito 246839
	allow system_mail_t mail_spool_t:lnk_file create_lnk_perms;
Chris PeBenito 246839
	allow system_mail_t mail_spool_t:fifo_file rw_file_perms;
Chris PeBenito 246839
Chris PeBenito 246839
	allow system_mail_t mqueue_spool_t:dir create_dir_perms;
Chris PeBenito 246839
	allow system_mail_t mqueue_spool_t:file create_file_perms;
Chris PeBenito 246839
	allow system_mail_t mqueue_spool_t:lnk_file create_lnk_perms;
Chris PeBenito 246839
Chris PeBenito 88dd38
	# for reading .forward - maybe we need a new type for it?
Chris PeBenito 88dd38
	# also for delivering mail to maildir
Chris PeBenito 88dd38
	# cjp: fix this to generic_user interfaces
Chris PeBenito 103fe2
	userdom_manage_user_home_content_dirs(user,mailserver_delivery)
Chris PeBenito 103fe2
	userdom_manage_generic_user_home_content_files(mailserver_delivery)
Chris PeBenito 103fe2
	userdom_manage_generic_user_home_content_symlinks(mailserver_delivery)
Chris PeBenito 103fe2
	userdom_manage_generic_user_home_content_sockets(mailserver_delivery)
Chris PeBenito 103fe2
	userdom_manage_generic_user_home_content_pipes(mailserver_delivery)
Chris PeBenito 103fe2
	userdom_generic_user_home_dir_filetrans_generic_user_home_content(mailserver_delivery,{ dir file lnk_file sock_file fifo_file })
Chris PeBenito 88dd38
Chris PeBenito af4752
# cjp: another require-in-else to resolve
Chris PeBenito bb7170
#	optional_policy(`',`
Chris PeBenito fb63d0
		corecmd_exec_all_executables(system_mail_t)
Chris PeBenito 246839
Chris PeBenito 246839
		files_exec_etc_files(system_mail_t)
Chris PeBenito 246839
Chris PeBenito 246839
		libs_exec_ld_so(system_mail_t)
Chris PeBenito 246839
		libs_exec_lib_files(system_mail_t)
Chris PeBenito af4752
#	')
Chris PeBenito 246839
')
Chris PeBenito 246839
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito e749cd
	apache_read_squirrelmail_data(system_mail_t)
Chris PeBenito e749cd
	apache_append_squirrelmail_data(system_mail_t)
Chris PeBenito e749cd
Chris PeBenito e749cd
	# apache should set close-on-exec
Chris PeBenito e749cd
	apache_dontaudit_append_log(system_mail_t)
Chris PeBenito 1815ba
	apache_dontaudit_rw_stream_sockets(system_mail_t)
Chris PeBenito 1815ba
	apache_dontaudit_rw_tcp_sockets(system_mail_t)
Chris PeBenito 1815ba
	apache_dontaudit_rw_sys_script_stream_sockets(system_mail_t)
Chris PeBenito e749cd
')
Chris PeBenito e749cd
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 1504ff
	arpwatch_manage_tmp_files(system_mail_t)
Chris PeBenito 1504ff
Chris PeBenito 1504ff
	ifdef(`hide_broken_symptoms', `
Chris PeBenito 1815ba
		arpwatch_dontaudit_rw_packet_sockets(system_mail_t)
Chris PeBenito 1504ff
	')
Chris PeBenito e8d0a6
')
Chris PeBenito e8d0a6
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 246839
	cron_read_system_job_tmp_files(system_mail_t)
Chris PeBenito 1815ba
	cron_dontaudit_write_pipes(system_mail_t)
Chris PeBenito 246839
')
Chris PeBenito 246839
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 93070c
	cvs_read_data(system_mail_t)
Chris PeBenito 93070c
')
Chris PeBenito 93070c
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 246839
	logrotate_read_tmp_files(system_mail_t)
Chris PeBenito 246839
')
Chris PeBenito 246839
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 020cbe
	logwatch_read_tmp_files(system_mail_t)
Chris PeBenito 020cbe
')
Chris PeBenito 020cbe
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito f1e604
	nagios_read_tmp_files(system_mail_t)
Chris PeBenito f1e604
')
Chris PeBenito f1e604
Chris PeBenito f1e604
optional_policy(`
Chris PeBenito 04926d
	allow system_mail_t etc_aliases_t:dir create_dir_perms;
Chris PeBenito 04926d
	allow system_mail_t etc_aliases_t:file create_file_perms;
Chris PeBenito 04926d
	allow system_mail_t etc_aliases_t:lnk_file create_lnk_perms;
Chris PeBenito 04926d
	allow system_mail_t etc_aliases_t:sock_file create_file_perms;
Chris PeBenito 04926d
	allow system_mail_t etc_aliases_t:fifo_file create_file_perms;
Chris PeBenito 103fe2
	files_etc_filetrans(system_mail_t,etc_aliases_t,{ file lnk_file sock_file fifo_file })
Chris PeBenito 04926d
Chris PeBenito 15722e
	domain_use_interactive_fds(system_mail_t)
Chris PeBenito d3f715
Chris PeBenito 1504ff
	# postfix needs this for newaliases
Chris PeBenito 9e04f5
	files_getattr_tmp_dirs(system_mail_t)
Chris PeBenito 725926
Chris PeBenito 1504ff
	postfix_exec_master(system_mail_t)
Chris PeBenito b0d224
	postfix_read_config(system_mail_t)
Chris PeBenito b0d224
	postfix_search_spool(system_mail_t)
Chris PeBenito 7bba9d
Chris PeBenito 1504ff
	ifdef(`distro_redhat',`
Chris PeBenito 1504ff
		# compatability for old default main.cf
Chris PeBenito 103fe2
		postfix_config_filetrans(system_mail_t,etc_aliases_t,{ dir file lnk_file sock_file fifo_file })
Chris PeBenito 1504ff
	')
Chris PeBenito 1504ff
Chris PeBenito bb7170
	optional_policy(`
Chris PeBenito e1ee92
		cron_rw_tcp_sockets(system_mail_t)
Chris PeBenito 1504ff
	')
Chris PeBenito 246839
')
Chris PeBenito 246839
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 65e131
	qmail_domtrans_inject(system_mail_t)
Chris PeBenito 65e131
')
Chris PeBenito 65e131
Chris PeBenito 65e131
optional_policy(`
Chris PeBenito b6cc2f
	sxid_read_log(system_mail_t)
Chris PeBenito b6cc2f
')
Chris PeBenito b6cc2f
Chris PeBenito b6cc2f
optional_policy(`
Chris PeBenito 1815ba
	userdom_dontaudit_use_unpriv_users_ptys(system_mail_t)
Chris PeBenito df00b2
Chris PeBenito bb7170
	optional_policy(`
Chris PeBenito 1504ff
		cron_dontaudit_append_system_job_tmp_files(system_mail_t)
Chris PeBenito df00b2
	')
Chris PeBenito 7bba9d
')
Chris PeBenito 075c4f
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 1815ba
	smartmon_read_tmp_files(system_mail_t)
Chris PeBenito 871b68
')
Chris PeBenito 871b68
Chris PeBenito 1504ff
# should break this up among sections:
Chris PeBenito 725926
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 4483ee
	# why is mail delivered to a directory of type arpwatch_data_t?
Chris PeBenito 725926
	arpwatch_search_data(mailserver_delivery)
Chris PeBenito 4483ee
	arpwatch_manage_tmp_files(mta_user_agent)
Chris PeBenito 4483ee
	ifdef(`hide_broken_symptoms', `
Chris PeBenito 1815ba
		arpwatch_dontaudit_rw_packet_sockets(mta_user_agent)
Chris PeBenito 4483ee
	')
Chris PeBenito bb7170
	optional_policy(`
Chris PeBenito 1504ff
		cron_read_system_job_tmp_files(mta_user_agent)
Chris PeBenito 1504ff
	')
Chris PeBenito 4483ee
')
Chris PeBenito a77e65
Chris PeBenito a77e65
ifdef(`TODO',`
Chris PeBenito a77e65
# for the start script to run make -C /etc/mail
Chris PeBenito a77e65
allow initrc_t etc_mail_t:dir rw_dir_perms;
Chris PeBenito a77e65
allow initrc_t etc_mail_t:file create_file_perms;
Chris PeBenito a77e65
')