diff --git a/refpolicy/policy/modules/services/mta.if b/refpolicy/policy/modules/services/mta.if index e16be43..358ae9c 100644 --- a/refpolicy/policy/modules/services/mta.if +++ b/refpolicy/policy/modules/services/mta.if @@ -463,7 +463,7 @@ interface(`mta_exec',` ## Read mail server configuration. ## ## -## The type of the process performing this action. +## Domain allowed access. ## # interface(`mta_read_config',` @@ -482,7 +482,7 @@ interface(`mta_read_config',` ## Read mail address aliases. ## ## -## The type of the process performing this action. +## Domain allowed access. ## # interface(`mta_read_aliases',` @@ -495,6 +495,23 @@ interface(`mta_read_aliases',` allow $1 etc_aliases_t:file r_file_perms; ') +######################################## +## +## Type transition files created in /etc +## to the mail address aliases type. +## +## +## Domain allowed access. +## +# +interface(`mta_filetrans_etc_aliases',` + gen_require(` + type etc_aliases_t; + ') + + files_filetrans_etc($1,etc_aliases_t, file) +') + ####################################### # # mta_rw_aliases(domain) diff --git a/refpolicy/policy/modules/services/mta.te b/refpolicy/policy/modules/services/mta.te index 106df36..b569efc 100644 --- a/refpolicy/policy/modules/services/mta.te +++ b/refpolicy/policy/modules/services/mta.te @@ -129,10 +129,6 @@ optional_policy(`logwatch',` logwatch_read_tmp_files(system_mail_t) ') -#optional_policy(`sendmail',` -# files_filetrans_etc(sendmail_t,etc_aliases_t, file) -#') - optional_policy(`postfix',` allow system_mail_t etc_aliases_t:dir create_dir_perms; allow system_mail_t etc_aliases_t:file create_file_perms; diff --git a/refpolicy/policy/modules/services/sendmail.te b/refpolicy/policy/modules/services/sendmail.te index d406396..2a00b44 100644 --- a/refpolicy/policy/modules/services/sendmail.te +++ b/refpolicy/policy/modules/services/sendmail.te @@ -92,6 +92,7 @@ sysnet_read_config(sendmail_t) userdom_dontaudit_use_unpriv_user_fd(sendmail_t) userdom_dontaudit_search_sysadm_home_dir(sendmail_t) +mta_filetrans_etc_aliases(sendmail_t) # Write to /etc/aliases and /etc/mail. mta_rw_aliases(sendmail_t) # Write to /var/spool/mail and /var/spool/mqueue.