#

# Shared macro for mail clients

#

# Author: Ivan Gyurdiev <ivg2@cornell.edu>

#

########################################

# mail_client_domain(client, role_prefix)

#

define(`mail_client_domain', `

# Allow netstat

# Startup shellscripts

allow $1_t bin_t:dir r_dir_perms;

allow $1_t bin_t:lnk_file r_file_perms;

can_exec($1_t, bin_t)

r_dir_file($1_t, proc_net_t)

allow $1_t sysctl_net_t:dir search;

# Allow DNS

can_resolve($1_t)

# Allow POP/IMAP/SMTP/NNTP/LDAP/IPP(printing)

can_ypbind($1_t)

can_network_client_tcp($1_t, { pop_port_t smtp_port_t innd_port_t ldap_port_t ipp_port_t })

allow $1_t { pop_port_t smtp_port_t innd_port_t ldap_port_t ipp_port_t }:tcp_socket name_connect;

# Allow printing the mail

ifdef(`cups.te',`

allow $1_t cupsd_etc_t:dir r_dir_perms;

allow $1_t cupsd_rw_etc_t:file r_file_perms;

')

ifdef(`lpr.te', `

domain_auto_trans($1_t, lpr_exec_t, $2_lpr_t)

')

# Attachments

read_content($1_t, $2, mail)

# Save mail

write_untrusted($1_t, $2)

# Encrypt mail

ifdef(`gpg.te', `

domain_auto_trans($1_t, gpg_exec_t, $2_gpg_t)

allow $1_t $2_gpg_t:process signal;

')

# Start links in web browser

ifdef(`mozilla.te', `

can_exec($1_t, shell_exec_t)

domain_auto_trans($1_t, mozilla_exec_t, $2_mozilla_t)

') 

ifdef(`dbusd.te', `

dbusd_client(system, $1)

allow $1_t system_dbusd_t:dbus send_msg;

dbusd_client($2, $1)

allow $1_t $2_dbusd_t:dbus send_msg;

ifdef(`cups.te', `

allow cupsd_t $1_t:dbus send_msg;

') 

') 

# Allow the user domain to signal/ps.

can_ps($2_t, $1_t)

allow $2_t $1_t:process signal_perms;

')