#

# Macros for sendmail domains.

#

#

# Authors:  Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser 

#           Russell Coker <russell@coker.com.au>

#

#

# sendmail_user_domain(domain_prefix)

#

# Define a derived domain for the sendmail program when executed by

# a user domain to send outgoing mail.  These domains are separate and

# independent of the domain used for the sendmail daemon process.

#

undefine(`sendmail_user_domain')

define(`sendmail_user_domain', `

# Use capabilities

allow $1_mail_t self:capability net_bind_service;

tmp_domain($1_mail)

# Write to /var/spool/mail and /var/spool/mqueue.

allow $1_mail_t mail_spool_t:dir rw_dir_perms;

allow $1_mail_t mail_spool_t:file create_file_perms;

allow $1_mail_t mqueue_spool_t:dir rw_dir_perms;

allow $1_mail_t mqueue_spool_t:file create_file_perms;

# Write to /var/log/sendmail.st

file_type_auto_trans($1_mail_t, var_log_t, sendmail_log_t)

allow $1_mail_t etc_mail_t:dir { getattr search };

allow $1_mail_t { var_t var_spool_t }:dir getattr;

allow $1_mail_t etc_runtime_t:file { getattr read };

# Check available space.

allow $1_mail_t fs_t:filesystem getattr;

allow $1_mail_t sysctl_kernel_t:dir search;

ifelse(`$1', `sysadm', `

allow $1_mail_t proc_t:dir { getattr search };

allow $1_mail_t proc_t:{ lnk_file file } { getattr read };

dontaudit $1_mail_t proc_net_t:dir search;

allow $1_mail_t sysctl_kernel_t:file { getattr read };

allow $1_mail_t etc_runtime_t:file { getattr read };

', `

dontaudit $1_mail_t proc_t:dir search;

dontaudit $1_mail_t sysctl_kernel_t:file read;

')dnl end if sysadm

')