Chris PeBenito ab58ad
#DESC MTA - Mail agents
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
# Author: Russell Coker <russell@coker.com.au>
Chris PeBenito ab58ad
# X-Debian-Packages: postfix exim sendmail sendmail-wide
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
# policy for all mail servers, including allowing user to send mail from the
Chris PeBenito ab58ad
# command-line and for cron jobs to use sendmail -t
Chris PeBenito ab58ad
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
# sendmail_exec_t is the type of /usr/sbin/sendmail
Chris PeBenito ab58ad
#
Chris PeBenito ab58ad
# define sendmail_exec_t if sendmail.te does not do it for us
Chris PeBenito ab58ad
ifdef(`sendmail.te', `', `
Chris PeBenito ab58ad
type sendmail_exec_t, file_type, exec_type, sysadmfile;
Chris PeBenito ab58ad
')
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# create a system_mail_t domain for daemons, init scripts, etc when they run
Chris PeBenito ab58ad
# "mail user@domain"
Chris PeBenito ab58ad
mail_domain(system)
Chris PeBenito ab58ad
Chris PeBenito ab58ad
ifdef(`targeted_policy', `
Chris PeBenito ab58ad
# rules are currently defined in sendmail.te, but it is not included in 
Chris PeBenito ab58ad
# targeted policy.  We could move these rules permanantly here.
Chris PeBenito ab58ad
ifdef(`postfix.te', `', `can_exec_any(system_mail_t)')
Chris PeBenito ab58ad
allow system_mail_t self:dir search;
Chris PeBenito ab58ad
allow system_mail_t self:lnk_file read;
Chris PeBenito ab58ad
r_dir_file(system_mail_t, { proc_t proc_net_t })
Chris PeBenito ab58ad
allow system_mail_t fs_t:filesystem getattr;
Chris PeBenito ab58ad
allow system_mail_t { var_t var_spool_t }:dir getattr;
Chris PeBenito ab58ad
create_dir_file(system_mail_t, mqueue_spool_t)
Chris PeBenito ab58ad
create_dir_file(system_mail_t, mail_spool_t)
Chris PeBenito ab58ad
allow system_mail_t mail_spool_t:fifo_file rw_file_perms;
Chris PeBenito ab58ad
allow system_mail_t etc_mail_t:file { getattr read };
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# for reading .forward - maybe we need a new type for it?
Chris PeBenito ab58ad
# also for delivering mail to maildir
Chris PeBenito ab58ad
file_type_auto_trans(mta_delivery_agent, user_home_dir_t, user_home_t)
Chris PeBenito ab58ad
', `
Chris PeBenito ab58ad
ifdef(`sendmail.te', `
Chris PeBenito ab58ad
# sendmail has an ugly design, the one process parses input from the user and
Chris PeBenito ab58ad
# then does system things with it.
Chris PeBenito ab58ad
domain_auto_trans(initrc_t, sendmail_exec_t, sendmail_t)
Chris PeBenito ab58ad
', `
Chris PeBenito ab58ad
domain_auto_trans(initrc_t, sendmail_exec_t, system_mail_t)
Chris PeBenito ab58ad
')
Chris PeBenito ab58ad
allow initrc_t sendmail_exec_t:lnk_file { getattr read };
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# allow the sysadmin to do "mail someone < /home/user/whatever"
Chris PeBenito ab58ad
allow sysadm_mail_t user_home_dir_type:dir search;
Chris PeBenito ab58ad
r_dir_file(sysadm_mail_t, user_home_type)
Chris PeBenito ab58ad
')
Chris PeBenito ab58ad
# for a mail server process that does things in response to a user command
Chris PeBenito ab58ad
allow mta_user_agent userdomain:process sigchld;
Chris PeBenito ab58ad
allow mta_user_agent { userdomain privfd }:fd use;
Chris PeBenito ab58ad
ifdef(`crond.te', `
Chris PeBenito ab58ad
allow mta_user_agent crond_t:process sigchld;
Chris PeBenito ab58ad
')
Chris PeBenito ab58ad
allow mta_user_agent sysadm_t:fifo_file { read write };
Chris PeBenito ab58ad
Chris PeBenito ab58ad
allow { system_mail_t mta_user_agent } privmail:fd use;
Chris PeBenito ab58ad
allow { system_mail_t mta_user_agent } privmail:process sigchld;
Chris PeBenito ab58ad
allow { system_mail_t mta_user_agent } privmail:fifo_file { read write };
Chris PeBenito ab58ad
allow { system_mail_t mta_user_agent } admin_tty_type:chr_file { read write };
Chris PeBenito ab58ad
Chris PeBenito ab58ad
allow mta_delivery_agent home_root_t:dir { getattr search };
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# for /var/spool/mail
Chris PeBenito ab58ad
ra_dir_create_file(mta_delivery_agent, mail_spool_t)
Chris PeBenito ab58ad
Chris PeBenito ab58ad
# for piping mail to a command
Chris PeBenito ab58ad
can_exec(mta_delivery_agent, shell_exec_t)
Chris PeBenito ab58ad
allow mta_delivery_agent bin_t:dir search;
Chris PeBenito ab58ad
allow mta_delivery_agent bin_t:lnk_file read;
Chris PeBenito ab58ad
allow mta_delivery_agent devtty_t:chr_file rw_file_perms;
Chris PeBenito ab58ad
allow mta_delivery_agent { etc_runtime_t proc_t }:file { getattr read };
Chris PeBenito ab58ad
Chris PeBenito ab58ad
allow system_mail_t etc_runtime_t:file { getattr read };
Chris PeBenito ab58ad
allow system_mail_t { random_device_t urandom_device_t }:chr_file { getattr read };
Chris PeBenito ab58ad
ifdef(`targeted_policy', `
Chris PeBenito ab58ad
typealias system_mail_t alias sysadm_mail_t;
Chris PeBenito ab58ad
')
Chris PeBenito ab58ad