#DESC Amavis - Anti-virus
#
# Author:  Brian May <bam@snoopy.apana.org.au>
# X-Debian-Packages: amavis-ng amavisd-new amavisd-new-milter amavisd-new-milter-helper
# Depends: clamav.te
#

#################################
#
# Rules for the amavisd_t domain.
#
type amavisd_etc_t, file_type, sysadmfile;
type amavisd_lib_t, file_type, sysadmfile;

type amavis_port_t, port_type;
daemon_domain(amavisd)
tmp_domain(amavisd)

allow initrc_t amavisd_lib_t:dir { search read write rmdir remove_name unlink };
allow initrc_t amavisd_lib_t:file unlink;
allow initrc_t amavisd_var_run_t:dir setattr;
allow amavisd_t self:capability { chown dac_override setgid setuid };
dontaudit amavisd_t self:capability sys_tty_config;

allow amavisd_t usr_t:{ file lnk_file } { getattr read };
dontaudit amavisd_t usr_t:file ioctl;

# networking
can_network(amavisd_t)
can_ypbind(amavisd_t);
can_tcp_connect(mail_server_sender, amavisd_t);
can_tcp_connect(amavisd_t, mail_server_domain)
allow amavisd_t amavis_port_t:tcp_socket name_bind;

ifdef(`scannerdaemon.te', `
can_tcp_connect(amavisd_t, scannerdaemon_t);
allow scannerdaemon_t amavisd_lib_t:dir r_dir_perms;
allow scannerdaemon_t amavisd_lib_t:file r_file_perms;
')

ifdef(`clamav.te', `
clamscan_domain(amavisd)
role system_r types amavisd_clamscan_t;
domain_auto_trans(amavisd_t, clamscan_exec_t, amavisd_clamscan_t)
allow amavisd_clamscan_t amavisd_lib_t:dir r_dir_perms;
allow amavisd_clamscan_t amavisd_lib_t:file r_file_perms;
can_clamd_connect(amavisd)
allow clamd_t amavisd_lib_t:dir r_dir_perms;
allow clamd_t amavisd_lib_t:file r_file_perms;
')

# Can create unix sockets
allow amavisd_t self:unix_stream_socket create_stream_socket_perms;
allow amavisd_t self:unix_dgram_socket create_socket_perms;
allow amavisd_t self:fifo_file getattr;

read_locale(amavisd_t)

# Access config files (amavisd).
allow amavisd_t amavisd_etc_t:file r_file_perms;

log_domain(amavisd)

# Access amavisd var/lib files.
create_dir_file(amavisd_t, amavisd_lib_t)

# Run helper programs.
can_exec_any(amavisd_t,bin_t)
allow amavisd_t bin_t:dir { getattr search };
allow amavisd_t sbin_t:dir search;
allow amavisd_t var_lib_t:dir search;

# allow access to files for scanning (required for amavis):
allow clamd_t self:capability { dac_override dac_read_search };

# unknown stuff
allow amavisd_t self:fifo_file { ioctl read write };
allow amavisd_t { random_device_t urandom_device_t }:chr_file read;
allow amavisd_t proc_t:file { getattr read };
allow amavisd_t etc_runtime_t:file { getattr read };

# broken stuff
dontaudit amavisd_t sysadm_home_dir_t:dir search;
dontaudit amavisd_t shadow_t:file { getattr read };
dontaudit amavisd_t sysadm_devpts_t:chr_file { read write };