diff --git a/refpolicy/policy/modules/kernel/files.fc b/refpolicy/policy/modules/kernel/files.fc index 3316660..5fc259e 100644 --- a/refpolicy/policy/modules/kernel/files.fc +++ b/refpolicy/policy/modules/kernel/files.fc @@ -17,7 +17,7 @@ ifdef(`distro_redhat',` ') ifdef(`distro_suse',` -/success -- gen_context(system_u:object_r:etc_runtime_t,s0) +/success -- gen_context(system_u:object_r:etc_runtime_t,s0) ') # @@ -44,7 +44,7 @@ ifdef(`distro_redhat',` /etc/blkid\.tab.* -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/fstab\.REVOKE -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/HOSTNAME -- gen_context(system_u:object_r:etc_runtime_t,s0) -/etc/ioctl\.save -- gen_context(system_u:object_r:etc_runtime_t,s0) +/etc/ioctl\.save -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/issue -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/issue\.net -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/localtime -l gen_context(system_u:object_r:etc_t,s0) @@ -164,7 +164,7 @@ HOME_ROOT/lost\+found/.* <<none>> /tmp/.* <<none>> /tmp/\.journal <<none>> -/tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,s15:c0.c255) +/tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,s15:c0.c255) /tmp/lost\+found/.* <<none>> # @@ -186,14 +186,14 @@ HOME_ROOT/lost\+found/.* <<none>> /usr/local/src(/.*)? gen_context(system_u:object_r:src_t,s0) -/usr/lost\+found -d gen_context(system_u:object_r:lost_found_t,s15:c0.c255) +/usr/lost\+found -d gen_context(system_u:object_r:lost_found_t,s15:c0.c255) /usr/lost\+found/.* <<none>> /usr/share(/.*)?/lib(64)?(/.*)? gen_context(system_u:object_r:usr_t,s0) /usr/src(/.*)? gen_context(system_u:object_r:src_t,s0) -/usr/tmp -d gen_context(system_u:object_r:tmp_t,s0-s15:c0.c255) +/usr/tmp -d gen_context(system_u:object_r:tmp_t,s0-s15:c0.c255) /usr/tmp/.* <<none>> # @@ -212,16 +212,17 @@ HOME_ROOT/lost\+found/.* <<none>> /var/lock(/.*)? gen_context(system_u:object_r:var_lock_t,s0) -/var/lost\+found -d gen_context(system_u:object_r:lost_found_t,s15:c0.c255) +/var/lost\+found -d gen_context(system_u:object_r:lost_found_t,s15:c0.c255) /var/lost\+found/.* <<none>> -/var/run -d gen_context(system_u:object_r:var_run_t,s0-s15:c0.c255) +/var/run -d gen_context(system_u:object_r:var_run_t,s0-s15:c0.c255) /var/run/.* gen_context(system_u:object_r:var_run_t,s0) /var/run/.*\.*pid <<none>> -/var/spool(/.*)? gen_context(system_u:object_r:var_spool_t,s0) +/var/spool(/.*)? gen_context(system_u:object_r:var_spool_t,s0) +/var/spool/postfix/etc(/.*)? gen_context(system_u:object_r:etc_t,s0) -/var/tmp -d gen_context(system_u:object_r:tmp_t,s0-s15:c0.c255) +/var/tmp -d gen_context(system_u:object_r:tmp_t,s0-s15:c0.c255) /var/tmp/.* <<none>> /var/tmp/lost\+found -d gen_context(system_u:object_r:lost_found_t,s15:c0.c255) /var/tmp/lost\+found/.* <<none>> diff --git a/refpolicy/policy/modules/services/mta.fc b/refpolicy/policy/modules/services/mta.fc index 72c5818..7a677d6 100644 --- a/refpolicy/policy/modules/services/mta.fc +++ b/refpolicy/policy/modules/services/mta.fc @@ -1,19 +1,23 @@ -/etc/aliases -- gen_context(system_u:object_r:etc_aliases_t,s0) +/etc/aliases -- gen_context(system_u:object_r:etc_aliases_t,s0) /etc/aliases\.db -- gen_context(system_u:object_r:etc_aliases_t,s0) -/etc/mail(/.*)? gen_context(system_u:object_r:etc_mail_t,s0) +/etc/mail(/.*)? gen_context(system_u:object_r:etc_mail_t,s0) +ifdef(`distro_redhat',` +/etc/postfix/aliases.* gen_context(system_u:object_r:etc_aliases_t,s0) +') -/usr/lib(64)?/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) +/usr/lib(64)?/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) -/usr/sbin/sendmail(.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0) +/usr/sbin/rmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) +/usr/sbin/sendmail.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0) +/usr/sbin/sendmail(.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0) -/var/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) +/var/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) -/var/spool/imap(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) -/var/spool/(client)?mqueue(/.*)? gen_context(system_u:object_r:mqueue_spool_t,s0) -/var/spool/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) +/var/spool/imap(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) +/var/spool/(client)?mqueue(/.*)? gen_context(system_u:object_r:mqueue_spool_t,s0) +/var/spool/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) -ifdef(`postfix.te', `', ` -/usr/sbin/sendmail.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0) -/var/spool/postfix(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) -') +#ifdef(`postfix.te', `', ` +#/var/spool/postfix(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) +#') diff --git a/refpolicy/policy/modules/services/postfix.fc b/refpolicy/policy/modules/services/postfix.fc index ce02866..696b5c5 100644 --- a/refpolicy/policy/modules/services/postfix.fc +++ b/refpolicy/policy/modules/services/postfix.fc @@ -1,19 +1,18 @@ # postfix /etc/postfix(/.*)? gen_context(system_u:object_r:postfix_etc_t,s0) ifdef(`distro_redhat', ` -/etc/postfix/aliases.* gen_context(system_u:object_r:etc_aliases_t,s0) /usr/libexec/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0) /usr/libexec/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0) -/usr/libexec/postfix/local -- gen_context(system_u:object_r:postfix_local_exec_t,s0) -/usr/libexec/postfix/master -- gen_context(system_u:object_r:postfix_master_exec_t,s0) -/usr/libexec/postfix/pickup -- gen_context(system_u:object_r:postfix_pickup_exec_t,s0) -/usr/libexec/postfix/(n)?qmgr -- gen_context(system_u:object_r:postfix_qmgr_exec_t,s0) -/usr/libexec/postfix/showq -- gen_context(system_u:object_r:postfix_showq_exec_t,s0) -/usr/libexec/postfix/smtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0) -/usr/libexec/postfix/scache -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0) -/usr/libexec/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0) -/usr/libexec/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0) -/usr/libexec/postfix/pipe -- gen_context(system_u:object_r:postfix_pipe_exec_t,s0) +/usr/libexec/postfix/local -- gen_context(system_u:object_r:postfix_local_exec_t,s0) +/usr/libexec/postfix/master -- gen_context(system_u:object_r:postfix_master_exec_t,s0) +/usr/libexec/postfix/pickup -- gen_context(system_u:object_r:postfix_pickup_exec_t,s0) +/usr/libexec/postfix/(n)?qmgr -- gen_context(system_u:object_r:postfix_qmgr_exec_t,s0) +/usr/libexec/postfix/showq -- gen_context(system_u:object_r:postfix_showq_exec_t,s0) +/usr/libexec/postfix/smtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0) +/usr/libexec/postfix/scache -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0) +/usr/libexec/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0) +/usr/libexec/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0) +/usr/libexec/postfix/pipe -- gen_context(system_u:object_r:postfix_pipe_exec_t,s0) ', ` /usr/lib/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0) /usr/lib/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0) @@ -40,20 +39,10 @@ ifdef(`distro_redhat', ` /usr/sbin/postmap -- gen_context(system_u:object_r:postfix_map_exec_t,s0) /usr/sbin/postqueue -- gen_context(system_u:object_r:postfix_postqueue_exec_t,s0) /usr/sbin/postsuper -- gen_context(system_u:object_r:postfix_master_exec_t,s0) -/usr/sbin/rmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) -/usr/sbin/sendmail.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0) -/var/spool/postfix(/.*)? gen_context(system_u:object_r:postfix_spool_t,s0) +/var/spool/postfix(/.*)? gen_context(system_u:object_r:postfix_spool_t,s0) /var/spool/postfix/maildrop(/.*)? gen_context(system_u:object_r:postfix_spool_maildrop_t,s0) -/var/spool/postfix/pid -d gen_context(system_u:object_r:var_run_t,s0) /var/spool/postfix/pid/.* gen_context(system_u:object_r:postfix_var_run_t,s0) /var/spool/postfix/private(/.*)? gen_context(system_u:object_r:postfix_private_t,s0) /var/spool/postfix/public(/.*)? gen_context(system_u:object_r:postfix_public_t,s0) /var/spool/postfix/bounce(/.*)? gen_context(system_u:object_r:postfix_spool_bounce_t,s0) /var/spool/postfix/flush(/.*)? gen_context(system_u:object_r:postfix_spool_flush_t,s0) -/var/spool/postfix/etc(/.*)? gen_context(system_u:object_r:etc_t,s0) -/var/spool/postfix/lib(64)?(/.*)? gen_context(system_u:object_r:lib_t,s0) -/var/spool/postfix/usr(/.*)? gen_context(system_u:object_r:lib_t,s0) -/var/spool/postfix/lib(64)?/ld.*\.so.* -- gen_context(system_u:object_r:ld_so_t,s0) -/var/spool/postfix/lib(64)?/lib.*\.so.* -- gen_context(system_u:object_r:shlib_t,s0) -/var/spool/postfix/lib(64)?/[^/]*/lib.*\.so.* -- gen_context(system_u:object_r:shlib_t,s0) -/var/spool/postfix/lib(64)?/devfsd/.*\.so.* -- gen_context(system_u:object_r:shlib_t,s0) diff --git a/refpolicy/policy/modules/system/libraries.fc b/refpolicy/policy/modules/system/libraries.fc index b563a0d..b24ad99 100644 --- a/refpolicy/policy/modules/system/libraries.fc +++ b/refpolicy/policy/modules/system/libraries.fc @@ -190,3 +190,10 @@ ifdef(`distro_suse',` ifdef(`distro_suse',` /var/lib/samba/bin/.*\.so(\.[^/]*)* -l gen_context(system_u:object_r:lib_t,s0) ') + +/var/spool/postfix/lib(64)?(/.*)? gen_context(system_u:object_r:lib_t,s0) +/var/spool/postfix/usr(/.*)? gen_context(system_u:object_r:lib_t,s0) +/var/spool/postfix/lib(64)?/ld.*\.so.* -- gen_context(system_u:object_r:ld_so_t,s0) +/var/spool/postfix/lib(64)?/lib.*\.so.* -- gen_context(system_u:object_r:shlib_t,s0) +/var/spool/postfix/lib(64)?/[^/]*/lib.*\.so.* -- gen_context(system_u:object_r:shlib_t,s0) +/var/spool/postfix/lib(64)?/devfsd/.*\.so.* -- gen_context(system_u:object_r:shlib_t,s0) diff --git a/refpolicy/policy/modules/system/logging.fc b/refpolicy/policy/modules/system/logging.fc index ad83e09..250db31 100644 --- a/refpolicy/policy/modules/system/logging.fc +++ b/refpolicy/policy/modules/system/logging.fc @@ -36,5 +36,6 @@ ifdef(`distro_suse', ` /var/run/metalog\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,s0) /var/run/syslogd\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,s0) -/var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0) +/var/spool/postfix/pid -d gen_context(system_u:object_r:var_run_t,s0) +/var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)