#DESC Dovecot POP and IMAP servers

#

# Author:  Russell Coker <russell@coker.com.au>

# X-Debian-Packages: dovecot-imapd, dovecot-pop3d

daemon_domain(dovecot, `, privhome')

allow dovecot_t dovecot_var_run_t:sock_file create_file_perms;

can_exec(dovecot_t, dovecot_exec_t)

type dovecot_cert_t, file_type, sysadmfile;

allow dovecot_t self:capability { dac_override dac_read_search chown net_bind_service setgid setuid sys_chroot };

allow dovecot_t self:process setrlimit;

can_network_tcp(dovecot_t)

can_ypbind(dovecot_t)

allow dovecot_t self:unix_dgram_socket create_socket_perms;

allow dovecot_t self:unix_stream_socket create_stream_socket_perms;

can_unix_connect(dovecot_t, self)

allow dovecot_t etc_t:file { getattr read };

allow dovecot_t initrc_var_run_t:file getattr;

allow dovecot_t bin_t:dir { getattr search };

can_exec(dovecot_t, bin_t)

allow dovecot_t pop_port_t:tcp_socket name_bind;

allow dovecot_t urandom_device_t:chr_file read;

allow dovecot_t cert_t:dir search;

allow dovecot_t dovecot_cert_t:file { getattr read };

allow dovecot_t { self proc_t }:file { getattr read };

allow dovecot_t self:fifo_file rw_file_perms;

can_kerberos(dovecot_t)

allow dovecot_t tmp_t:dir search;

rw_dir_file(dovecot_t, mail_spool_t)

allow dovecot_t mail_spool_t:lnk_file read;

allow dovecot_t var_spool_t:dir { search };

daemon_sub_domain(dovecot_t, dovecot_auth, `, auth_chkpwd')

allow dovecot_auth_t self:process { fork signal_perms };

allow dovecot_auth_t dovecot_t:unix_stream_socket { getattr accept read write ioctl };

allow dovecot_auth_t self:unix_dgram_socket create_socket_perms;

allow dovecot_auth_t self:unix_stream_socket create_stream_socket_perms;

allow dovecot_auth_t self:fifo_file rw_file_perms;

allow dovecot_auth_t urandom_device_t:chr_file { getattr read };

allow dovecot_auth_t etc_t:file { getattr read };

allow dovecot_auth_t { self proc_t }:file { getattr read };

read_locale(dovecot_auth_t)

read_sysctl(dovecot_auth_t)

allow dovecot_auth_t sysctl_t:dir search;

dontaudit dovecot_auth_t selinux_config_t:dir search;