diff --git a/policy/modules/services/amavis.if b/policy/modules/services/amavis.if index db18f31..22523cd 100644 --- a/policy/modules/services/amavis.if +++ b/policy/modules/services/amavis.if @@ -18,11 +18,30 @@ interface(`amavis_domtrans',` type amavis_t, amavis_exec_t; ') + corecmd_search_bin($1) domtrans_pattern($1, amavis_exec_t, amavis_t) ') ######################################## ## +## Execute amavis server in the amavis domain. +## +## +## +## The type of the process performing this action. +## +## +# +interface(`amavis_initrc_domtrans',` + gen_require(` + type afs_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, amavis_initrc_exec_t) +') + +######################################## +## ## Read amavis spool files. ## ## @@ -209,13 +228,12 @@ interface(`amavis_admin',` type amavis_t, amavis_tmp_t, amavis_var_log_t; type amavis_spool_t, amavis_var_lib_t, amavis_var_run_t; type amavis_etc_t, amavis_quarantine_t; - type amavis_initrc_exec_t; ') allow $1 amavis_t:process { ptrace signal_perms }; ps_process_pattern($1, amavis_t) - init_labeled_script_domtrans($1, amavis_initrc_exec_t) + amavis_initrc_domtrans($1) domain_system_change_exemption($1) role_transition $2 amavis_initrc_exec_t system_r; allow $2 system_r;