Chris PeBenito 65e131
Chris PeBenito 65e131
policy_module(qmail,1.0.0)
Chris PeBenito 65e131
Chris PeBenito 65e131
########################################
Chris PeBenito 65e131
#
Chris PeBenito 65e131
# Declarations
Chris PeBenito 65e131
#
Chris PeBenito 65e131
Chris PeBenito 65e131
attribute qmail_user_domains;
Chris PeBenito 65e131
Chris PeBenito 65e131
type qmail_alias_home_t;
Chris PeBenito 65e131
files_type(qmail_alias_home_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
qmail_child_domain_template(qmail_clean, qmail_start_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
type qmail_etc_t;
Chris PeBenito 65e131
files_type(qmail_etc_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
type qmail_exec_t;
Chris PeBenito 65e131
files_type(qmail_exec_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
type qmail_inject_t, qmail_user_domains;
Chris PeBenito 65e131
type qmail_inject_exec_t;
Chris PeBenito 65e131
domain_type(qmail_inject_t)
Chris PeBenito 65e131
domain_entry_file(qmail_inject_t,qmail_inject_exec_t)
Chris PeBenito 65e131
mta_mailserver_user_agent(qmail_inject_t)
Chris PeBenito 65e131
role system_r types qmail_inject_t;
Chris PeBenito 65e131
Chris PeBenito 65e131
qmail_child_domain_template(qmail_local, qmail_lspawn_t)
Chris PeBenito 65e131
mta_mailserver_delivery(qmail_local_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
qmail_child_domain_template(qmail_lspawn, qmail_start_t)
Chris PeBenito 65e131
mta_mailserver_delivery(qmail_lspawn_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
qmail_child_domain_template(qmail_queue, qmail_inject_t)
Chris PeBenito 65e131
typeattribute qmail_queue_t qmail_user_domains;
Chris PeBenito 65e131
mta_mailserver_user_agent(qmail_queue_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
qmail_child_domain_template(qmail_remote, qmail_rspawn_t)
Chris PeBenito 65e131
mta_mailserver_sender(qmail_remote_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
qmail_child_domain_template(qmail_rspawn, qmail_start_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
qmail_child_domain_template(qmail_send, qmail_start_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
qmail_child_domain_template(qmail_smtpd, qmail_tcp_env_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
qmail_child_domain_template(qmail_splogger, qmail_start_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
type qmail_spool_t;
Chris PeBenito 65e131
files_type(qmail_spool_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
type qmail_start_t;
Chris PeBenito 65e131
type qmail_start_exec_t;
Chris PeBenito 65e131
init_daemon_domain(qmail_start_t,qmail_start_exec_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
type qmail_tcp_env_t;
Chris PeBenito 65e131
type qmail_tcp_env_exec_t;
Chris PeBenito 65e131
domain_type(qmail_tcp_env_t)
Chris PeBenito 65e131
domain_entry_file(qmail_tcp_env_t,qmail_tcp_env_exec_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
########################################
Chris PeBenito 65e131
#
Chris PeBenito 65e131
# qmail-clean local policy
Chris PeBenito 65e131
#   this component cleans up the queue directory
Chris PeBenito 65e131
#
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_clean_t qmail_spool_t:dir rw_dir_perms;
Chris PeBenito 65e131
allow qmail_clean_t qmail_spool_t:file { unlink read getattr };
Chris PeBenito 65e131
Chris PeBenito 65e131
########################################
Chris PeBenito 65e131
#
Chris PeBenito 65e131
# qmail-inject local policy
Chris PeBenito 65e131
#   this component preprocesses mail from stdin and invokes qmail-queue
Chris PeBenito 65e131
#
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_inject_t self:fifo_file write;
Chris PeBenito 65e131
allow qmail_inject_t self:process signal_perms;
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_inject_t qmail_queue_exec_t:file read;
Chris PeBenito 65e131
Chris PeBenito 65e131
corecmd_search_bin(qmail_inject_t)
Chris PeBenito 65e131
corecmd_search_sbin(qmail_inject_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
files_search_var(qmail_inject_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
libs_use_ld_so(qmail_inject_t)
Chris PeBenito 65e131
libs_use_shared_libs(qmail_inject_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
qmail_read_config(qmail_inject_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
########################################
Chris PeBenito 65e131
#
Chris PeBenito 65e131
# qmail-local local policy
Chris PeBenito 65e131
#   this component delivers a mail message
Chris PeBenito 65e131
#
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_local_t self:fifo_file write;
Chris PeBenito 65e131
allow qmail_local_t self:process signal_perms;
Chris PeBenito 65e131
allow qmail_local_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_local_t qmail_alias_home_t:dir create_dir_perms;
Chris PeBenito 65e131
allow qmail_local_t qmail_alias_home_t:file create_file_perms;
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_local_t qmail_queue_exec_t:file read;
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_local_t qmail_spool_t:file r_file_perms;
Chris PeBenito 65e131
Chris PeBenito 65e131
kernel_read_system_state(qmail_local_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
corecmd_exec_shell(qmail_local_t)
Chris PeBenito 65e131
corecmd_search_sbin(qmail_local_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
files_read_etc_files(qmail_local_t)
Chris PeBenito 65e131
files_read_etc_runtime_files(qmail_local_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
mta_append_spool(qmail_local_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
qmail_domtrans_queue(qmail_local_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
########################################
Chris PeBenito 65e131
#
Chris PeBenito 65e131
# qmail-lspawn local policy
Chris PeBenito 65e131
#   this component schedules local deliveries
Chris PeBenito 65e131
#
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_lspawn_t self:capability { setuid setgid };
Chris PeBenito 65e131
allow qmail_lspawn_t self:process signal_perms;
Chris PeBenito 65e131
allow qmail_lspawn_t self:fifo_file { read write };
Chris PeBenito 65e131
allow qmail_lspawn_t self:unix_stream_socket create_socket_perms;
Chris PeBenito 65e131
Chris PeBenito 65e131
can_exec(qmail_lspawn_t, qmail_exec_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_lspawn_t qmail_local_exec_t:file read;
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_lspawn_t qmail_spool_t:dir search;
Chris PeBenito 65e131
allow qmail_lspawn_t qmail_spool_t:file { read getattr };
Chris PeBenito 65e131
Chris PeBenito 65e131
corecmd_search_sbin(qmail_lspawn_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
files_read_etc_files(qmail_lspawn_t)
Chris PeBenito 65e131
files_search_pids(qmail_lspawn_t)
Chris PeBenito 65e131
files_search_tmp(qmail_lspawn_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
########################################
Chris PeBenito 65e131
#
Chris PeBenito 65e131
# qmail-queue local policy
Chris PeBenito 65e131
#   this component places a mail in a delivery queue, later to be processed by qmail-send
Chris PeBenito 65e131
#
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_queue_t qmail_lspawn_t:fd use;
Chris PeBenito 65e131
allow qmail_queue_t qmail_lspawn_t:fifo_file write;
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_queue_t qmail_smtpd_t:fd use;
Chris PeBenito 65e131
allow qmail_queue_t qmail_smtpd_t:fifo_file read;
Chris PeBenito 65e131
allow qmail_queue_t qmail_smtpd_t:process sigchld;
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_queue_t qmail_spool_t:dir create_dir_perms;
Chris PeBenito 65e131
allow qmail_queue_t qmail_spool_t:fifo_file { read write };
Chris PeBenito 65e131
allow qmail_queue_t qmail_spool_t:file create_file_perms;
Chris PeBenito 65e131
Chris PeBenito 65e131
optional_policy(`
Chris PeBenito 65e131
	daemontools_ipc_domain(qmail_queue_t)
Chris PeBenito 65e131
')
Chris PeBenito 65e131
Chris PeBenito 65e131
########################################
Chris PeBenito 65e131
#
Chris PeBenito 65e131
# qmail-remote local policy
Chris PeBenito 65e131
#   this component sends mail via SMTP
Chris PeBenito 65e131
#
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_remote_t self:tcp_socket create_socket_perms;
Chris PeBenito 65e131
allow qmail_remote_t self:udp_socket create_socket_perms;
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_remote_t qmail_spool_t:dir search;
Chris PeBenito 65e131
allow qmail_remote_t qmail_spool_t:file rw_file_perms;
Chris PeBenito 65e131
Chris PeBenito 65e131
corenet_non_ipsec_sendrecv(qmail_remote_t)
Chris PeBenito 65e131
corenet_tcp_sendrecv_generic_if(qmail_remote_t)
Chris PeBenito 65e131
corenet_udp_sendrecv_generic_if(qmail_remote_t)
Chris PeBenito 65e131
corenet_tcp_sendrecv_generic_node(qmail_remote_t)
Chris PeBenito 65e131
corenet_udp_sendrecv_generic_node(qmail_remote_t)
Chris PeBenito 65e131
corenet_tcp_sendrecv_smtp_port(qmail_remote_t)
Chris PeBenito 65e131
corenet_udp_sendrecv_dns_port(qmail_remote_t)
Chris PeBenito 65e131
corenet_tcp_connect_smtp_port(qmail_remote_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
dev_read_rand(qmail_remote_t)
Chris PeBenito 65e131
dev_read_urand(qmail_remote_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
sysnet_read_config(qmail_remote_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
########################################
Chris PeBenito 65e131
#
Chris PeBenito 65e131
# qmail-rspawn local policy
Chris PeBenito 65e131
#   this component scedules remote deliveries
Chris PeBenito 65e131
#
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_rspawn_t self:process signal_perms;
Chris PeBenito 65e131
allow qmail_rspawn_t self:fifo_file read;
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_rspawn_t qmail_remote_exec_t:file read;
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_rspawn_t qmail_spool_t:dir search;
Chris PeBenito 65e131
allow qmail_rspawn_t qmail_spool_t:file rw_file_perms;
Chris PeBenito 65e131
Chris PeBenito 65e131
corecmd_search_bin(qmail_rspawn_t)
Chris PeBenito 65e131
corecmd_search_sbin(qmail_rspawn_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
########################################
Chris PeBenito 65e131
#
Chris PeBenito 65e131
# qmail-send local policy
Chris PeBenito 65e131
#   this component delivers mail messages from the queue
Chris PeBenito 65e131
#
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_send_t self:process signal_perms;
Chris PeBenito 65e131
allow qmail_send_t self:fifo_file write;
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_send_t qmail_spool_t:dir create_dir_perms;
Chris PeBenito 65e131
allow qmail_send_t qmail_spool_t:file create_file_perms;
Chris PeBenito 65e131
allow qmail_send_t qmail_spool_t:fifo_file read;
Chris PeBenito 65e131
Chris PeBenito 65e131
qmail_domtrans_queue(qmail_send_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
optional_policy(`
Chris PeBenito 65e131
	daemontools_ipc_domain(qmail_send_t)
Chris PeBenito 65e131
')
Chris PeBenito 65e131
Chris PeBenito 65e131
########################################
Chris PeBenito 65e131
#
Chris PeBenito 65e131
# qmail-smtpd local policy
Chris PeBenito 65e131
#   this component receives mails via SMTP
Chris PeBenito 65e131
#
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_smtpd_t self:process signal_perms;
Chris PeBenito 65e131
allow qmail_smtpd_t self:fifo_file write;
Chris PeBenito 65e131
allow qmail_smtpd_t self:tcp_socket create_socket_perms;
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_smtpd_t qmail_queue_exec_t:file read;
Chris PeBenito 65e131
Chris PeBenito 65e131
dev_read_rand(qmail_smtpd_t)
Chris PeBenito 65e131
dev_read_urand(qmail_smtpd_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
qmail_domtrans_queue(qmail_smtpd_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
optional_policy(`
Chris PeBenito 65e131
	daemontools_ipc_domain(qmail_smtpd_t)
Chris PeBenito 65e131
')
Chris PeBenito 65e131
Chris PeBenito 65e131
optional_policy(`
Chris PeBenito 65e131
	ucspitcp_service_domain(qmail_smtpd_t, qmail_smtpd_exec_t)
Chris PeBenito 65e131
')
Chris PeBenito 65e131
Chris PeBenito 65e131
########################################
Chris PeBenito 65e131
#
Chris PeBenito 65e131
# splogger local policy
Chris PeBenito 65e131
#   this component creates entries in syslog
Chris PeBenito 65e131
#
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_splogger_t self:unix_dgram_socket create_socket_perms;
Chris PeBenito 65e131
Chris PeBenito 65e131
files_read_etc_files(qmail_splogger_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
init_dontaudit_use_script_fds(qmail_splogger_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
miscfiles_read_localization(qmail_splogger_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
########################################
Chris PeBenito 65e131
#
Chris PeBenito 65e131
# qmail-start local policy
Chris PeBenito 65e131
#   this component starts up the mail delivery component
Chris PeBenito 65e131
#
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_start_t self:capability { setgid setuid };
Chris PeBenito 65e131
dontaudit qmail_start_t self:capability sys_tty_config;
Chris PeBenito 65e131
allow qmail_start_t self:fifo_file { getattr read write };
Chris PeBenito 65e131
allow qmail_start_t self:process signal_perms;
Chris PeBenito 65e131
Chris PeBenito 65e131
can_exec(qmail_start_t, qmail_start_exec_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
corecmd_search_bin(qmail_start_t)
Chris PeBenito 65e131
corecmd_search_sbin(qmail_start_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
files_search_var(qmail_start_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
libs_use_ld_so(qmail_start_t)
Chris PeBenito 65e131
libs_use_shared_libs(qmail_start_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
qmail_read_config(qmail_start_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
optional_policy(`
Chris PeBenito 65e131
	daemontools_service_domain(qmail_start_t, qmail_start_exec_t)
Chris PeBenito 65e131
	daemontools_ipc_domain(qmail_start_t)
Chris PeBenito 65e131
')
Chris PeBenito 65e131
Chris PeBenito 65e131
########################################
Chris PeBenito 65e131
#
Chris PeBenito 65e131
# tcp-env local policy
Chris PeBenito 65e131
#   this component sets up TCP-related environment variables
Chris PeBenito 65e131
#
Chris PeBenito 65e131
Chris PeBenito 65e131
allow qmail_tcp_env_t qmail_smtpd_exec_t:file read;
Chris PeBenito 65e131
Chris PeBenito 65e131
corecmd_search_sbin(qmail_tcp_env_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
sysnet_read_config(qmail_tcp_env_t)
Chris PeBenito 65e131
Chris PeBenito 65e131
optional_policy(`
Chris PeBenito 65e131
	inetd_tcp_service_domain(qmail_tcp_env_t, qmail_tcp_env_exec_t)
Chris PeBenito 65e131
')
Chris PeBenito 65e131
Chris PeBenito 65e131
optional_policy(`
Chris PeBenito 65e131
	ucspitcp_service_domain(qmail_tcp_env_t, qmail_tcp_env_exec_t)
Chris PeBenito 65e131
')