#DESC Courier - POP and IMAP servers

#

# Author:  Russell Coker <russell@coker.com.au>

# X-Debian-Packages: courier-base

#

# Type for files created during execution of courier.

type courier_var_run_t, file_type, sysadmfile, pidfile;

type courier_var_lib_t, file_type, sysadmfile;

type courier_etc_t, file_type, sysadmfile;

typealias courier_etc_t alias etc_courier_t;

# allow start scripts to read the config

allow initrc_t courier_etc_t:file r_file_perms;

type courier_exec_t, file_type, sysadmfile, exec_type;

type sqwebmail_cron_exec_t, file_type, sysadmfile, exec_type;

define(`courier_domain', `

#################################

#

# Rules for the courier_$1_t domain.

#

# courier_$1_exec_t is the type of the courier_$1 executables.

#

daemon_base_domain(courier_$1, `$2')

allow courier_$1_t var_run_t:dir search;

rw_dir_create_file(courier_$1_t, courier_var_run_t)

allow courier_$1_t courier_var_run_t:sock_file create_file_perms;

# allow it to read config files etc

allow courier_$1_t { courier_etc_t var_t }:dir r_dir_perms;

allow courier_$1_t courier_etc_t:file r_file_perms;

allow courier_$1_t etc_t:dir r_dir_perms;

allow courier_$1_t etc_t:file r_file_perms;

# execute scripts etc

allow courier_$1_t { bin_t courier_$1_exec_t }:file rx_file_perms;

allow courier_$1_t bin_t:dir r_dir_perms;

allow courier_$1_t fs_t:filesystem getattr;

# set process group and allow permissions over-ride

allow courier_$1_t self:process setpgid;

allow courier_$1_t self:capability dac_override;

# Use the network.

can_network_server(courier_$1_t)

allow courier_$1_t self:fifo_file { read write getattr };

allow courier_$1_t self:unix_stream_socket create_stream_socket_perms;

allow courier_$1_t self:unix_dgram_socket create_socket_perms;

allow courier_$1_t null_device_t:chr_file rw_file_perms;

# allow it to log to /dev/tty

allow courier_$1_t devtty_t:chr_file rw_file_perms;

allow courier_$1_t { usr_t etc_runtime_t }:file r_file_perms;

allow courier_$1_t usr_t:dir r_dir_perms;

allow courier_$1_t root_t:dir r_dir_perms;

can_exec(courier_$1_t, courier_$1_exec_t)

can_exec(courier_$1_t, bin_t)

allow courier_$1_t bin_t:dir search;

allow courier_$1_t proc_t:dir r_dir_perms;

allow courier_$1_t proc_t:file r_file_perms;

')dnl

courier_domain(authdaemon, `, auth_chkpwd')

allow courier_authdaemon_t sbin_t:dir search;

allow courier_authdaemon_t lib_t:file { read getattr };

allow courier_authdaemon_t tmp_t:dir getattr;

allow courier_authdaemon_t self:file { getattr read };

read_locale(courier_authdaemon_t)

can_exec(courier_authdaemon_t, courier_exec_t)

dontaudit courier_authdaemon_t selinux_config_t:dir search;

# for SSP

allow courier_authdaemon_t urandom_device_t:chr_file read;

# should not be needed!

allow courier_authdaemon_t home_root_t:dir search;

allow courier_authdaemon_t user_home_dir_type:dir search;

dontaudit courier_authdaemon_t sysadm_home_dir_t:dir search;

allow courier_authdaemon_t self:unix_stream_socket connectto;

allow courier_authdaemon_t self:capability { setuid setgid sys_tty_config };

courier_domain(tcpd)

allow courier_tcpd_t self:capability { kill net_bind_service };

allow courier_tcpd_t pop_port_t:tcp_socket name_bind;

allow courier_tcpd_t sbin_t:dir search;

allow courier_tcpd_t var_lib_t:dir search;

# for TLS

allow courier_tcpd_t urandom_device_t:chr_file read;

read_locale(courier_tcpd_t)

can_exec(courier_tcpd_t, courier_exec_t)

allow courier_authdaemon_t courier_tcpd_t:{ unix_stream_socket tcp_socket } rw_stream_socket_perms;

allow courier_authdaemon_t courier_tcpd_t:process sigchld;

can_tcp_connect(userdomain, courier_tcpd_t)

rw_dir_create_file(courier_tcpd_t, courier_var_lib_t)

# domain for pop and imap

courier_domain(pop)

read_locale(courier_pop_t)

domain_auto_trans(courier_tcpd_t, courier_pop_exec_t, courier_pop_t)

allow courier_pop_t courier_tcpd_t:{ unix_stream_socket tcp_socket } rw_stream_socket_perms;

domain_auto_trans(courier_pop_t, courier_authdaemon_exec_t, courier_authdaemon_t)

allow courier_pop_t courier_authdaemon_t:tcp_socket rw_stream_socket_perms;

allow courier_authdaemon_t courier_tcpd_t:fd use;

allow courier_authdaemon_t courier_tcpd_t:tcp_socket rw_stream_socket_perms;

allow courier_authdaemon_t courier_tcpd_t:fifo_file rw_file_perms;

allow courier_pop_t courier_authdaemon_t:process sigchld;

domain_auto_trans(courier_authdaemon_t, courier_pop_exec_t, courier_pop_t)

# inherits file handle - should it?

allow courier_pop_t courier_var_lib_t:file { read write };

# do the actual work (read the Maildir)

# imap needs to write files

allow courier_pop_t home_root_t:dir { getattr search };

allow courier_pop_t user_home_dir_type:dir { getattr search };

# pop does not need to create subdirs, IMAP does

#rw_dir_create_file(courier_pop_t, user_home_type)

create_dir_file(courier_pop_t, user_home_type)

# for calendaring

courier_domain(pcp)

allow courier_pcp_t self:capability { setuid setgid };

allow courier_pcp_t random_device_t:chr_file r_file_perms;

# for webmail

courier_domain(sqwebmail)

ifdef(`crond.te', `

system_crond_entry(sqwebmail_cron_exec_t, courier_sqwebmail_t)

')

read_sysctl(courier_sqwebmail_t)