|
|
c70f043 |
policy_module(postfix, 1.14.0)
|
|
|
c70f043 |
|
|
|
c70f043 |
########################################
|
|
|
c70f043 |
#
|
|
|
c70f043 |
# Declarations
|
|
|
c70f043 |
#
|
|
|
c70f043 |
|
|
|
c70f043 |
## <desc>
|
|
|
c70f043 |
##
|
|
|
c70f043 |
## Allow postfix_local domain full write access to mail_spool directories
|
|
|
c70f043 |
##
|
|
|
c70f043 |
## </desc>
|
|
|
c70f043 |
gen_tunable(postfix_local_write_mail_spool, true)
|
|
|
c70f043 |
|
|
|
c70f043 |
attribute postfix_domain;
|
|
|
c70f043 |
attribute postfix_spool_type;
|
|
|
c70f043 |
attribute postfix_user_domains;
|
|
|
c70f043 |
# domains that transition to the
|
|
|
c70f043 |
# postfix user domains
|
|
|
c70f043 |
attribute postfix_user_domtrans;
|
|
|
c70f043 |
|
|
|
c70f043 |
postfix_server_domain_template(bounce)
|
|
|
c70f043 |
|
|
|
c70f043 |
type postfix_spool_bounce_t, postfix_spool_type;
|
|
|
c70f043 |
files_spool_file(postfix_spool_bounce_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
postfix_server_domain_template(cleanup)
|
|
|
c70f043 |
|
|
|
c70f043 |
type postfix_etc_t;
|
|
|
c70f043 |
files_config_file(postfix_etc_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
type postfix_exec_t;
|
|
|
c70f043 |
application_executable_file(postfix_exec_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
postfix_server_domain_template(local)
|
|
|
c70f043 |
mta_mailserver_delivery(postfix_local_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
# Program for creating database files
|
|
|
c70f043 |
type postfix_map_t;
|
|
|
c70f043 |
type postfix_map_exec_t;
|
|
|
c70f043 |
application_domain(postfix_map_t, postfix_map_exec_t)
|
|
|
c70f043 |
role system_r types postfix_map_t;
|
|
|
c70f043 |
|
|
|
c70f043 |
type postfix_map_tmp_t;
|
|
|
c70f043 |
files_tmp_file(postfix_map_tmp_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
postfix_domain_template(master)
|
|
|
c70f043 |
typealias postfix_master_t alias postfix_t;
|
|
|
c70f043 |
# alias is a hack to make the disable trans bool
|
|
|
c70f043 |
# generation macro work
|
|
|
c70f043 |
mta_mailserver(postfix_t, postfix_master_exec_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
type postfix_initrc_exec_t;
|
|
|
c70f043 |
init_script_file(postfix_initrc_exec_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
postfix_server_domain_template(pickup)
|
|
|
c70f043 |
|
|
|
c70f043 |
postfix_server_domain_template(pipe)
|
|
|
c70f043 |
|
|
|
c70f043 |
postfix_user_domain_template(postdrop)
|
|
|
c70f043 |
mta_mailserver_user_agent(postfix_postdrop_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
postfix_user_domain_template(postqueue)
|
|
|
c70f043 |
mta_mailserver_user_agent(postfix_postqueue_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
type postfix_private_t;
|
|
|
c70f043 |
files_type(postfix_private_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
type postfix_prng_t;
|
|
|
c70f043 |
files_type(postfix_prng_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
postfix_server_domain_template(qmgr)
|
|
|
c70f043 |
|
|
|
c70f043 |
postfix_user_domain_template(showq)
|
|
|
c70f043 |
|
|
|
c70f043 |
postfix_server_domain_template(smtp)
|
|
|
c70f043 |
mta_mailserver_sender(postfix_smtp_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
postfix_server_domain_template(smtpd)
|
|
|
c70f043 |
|
|
|
c70f043 |
type postfix_spool_t, postfix_spool_type;
|
|
|
c70f043 |
files_spool_file(postfix_spool_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
type postfix_spool_maildrop_t, postfix_spool_type;
|
|
|
c70f043 |
files_spool_file(postfix_spool_maildrop_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
type postfix_spool_flush_t, postfix_spool_type;
|
|
|
c70f043 |
files_spool_file(postfix_spool_flush_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
type postfix_public_t;
|
|
|
c70f043 |
files_type(postfix_public_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
type postfix_var_run_t;
|
|
|
c70f043 |
files_pid_file(postfix_var_run_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
# the data_directory config parameter
|
|
|
c70f043 |
type postfix_data_t;
|
|
|
c70f043 |
files_type(postfix_data_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
postfix_server_domain_template(virtual)
|
|
|
c70f043 |
mta_mailserver_delivery(postfix_virtual_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
########################################
|
|
|
c70f043 |
#
|
|
|
c70f043 |
# Postfix master process local policy
|
|
|
c70f043 |
#
|
|
|
c70f043 |
|
|
|
c70f043 |
# chown is to set the correct ownership of queue dirs
|
|
|
c70f043 |
allow postfix_master_t self:capability { chown dac_override kill setgid setuid net_bind_service sys_tty_config };
|
|
|
c70f043 |
allow postfix_master_t self:capability2 block_suspend;
|
|
|
c70f043 |
|
|
|
c70f043 |
allow postfix_master_t self:process setrlimit;
|
|
|
c70f043 |
allow postfix_master_t self:tcp_socket create_stream_socket_perms;
|
|
|
c70f043 |
allow postfix_master_t self:udp_socket create_socket_perms;
|
|
|
c70f043 |
|
|
|
c70f043 |
allow postfix_master_t postfix_etc_t:dir rw_dir_perms;
|
|
|
c70f043 |
allow postfix_master_t postfix_etc_t:file rw_file_perms;
|
|
|
c70f043 |
mta_filetrans_aliases(postfix_master_t, postfix_etc_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
can_exec(postfix_master_t, postfix_exec_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
allow postfix_master_t postfix_data_t:dir manage_dir_perms;
|
|
|
c70f043 |
allow postfix_master_t postfix_data_t:file manage_file_perms;
|
|
|
c70f043 |
|
|
|
c70f043 |
allow postfix_master_t postfix_map_exec_t:file { mmap_file_perms lock };
|
|
|
c70f043 |
|
|
|
c70f043 |
allow postfix_master_t postfix_postdrop_exec_t:file getattr_file_perms;
|
|
|
c70f043 |
|
|
|
c70f043 |
allow postfix_master_t postfix_postqueue_exec_t:file getattr_file_perms;
|
|
|
c70f043 |
|
|
|
c70f043 |
manage_fifo_files_pattern(postfix_master_t, postfix_private_t, postfix_private_t)
|
|
|
c70f043 |
manage_sock_files_pattern(postfix_master_t, postfix_private_t, postfix_private_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
domtrans_pattern(postfix_master_t, postfix_postqueue_exec_t, postfix_postqueue_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
allow postfix_master_t postfix_prng_t:file rw_file_perms;
|
|
|
c70f043 |
|
|
|
c70f043 |
manage_fifo_files_pattern(postfix_master_t, postfix_public_t, postfix_public_t)
|
|
|
c70f043 |
manage_sock_files_pattern(postfix_master_t, postfix_public_t, postfix_public_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
domtrans_pattern(postfix_master_t, postfix_showq_exec_t, postfix_showq_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
# allow access to deferred queue and allow removing bogus incoming entries
|
|
|
c70f043 |
manage_dirs_pattern(postfix_master_t, postfix_spool_t, postfix_spool_t)
|
|
|
c70f043 |
manage_files_pattern(postfix_master_t, postfix_spool_t, postfix_spool_t)
|
|
|
c70f043 |
files_spool_filetrans(postfix_master_t, postfix_spool_t, dir)
|
|
|
c70f043 |
|
|
|
c70f043 |
allow postfix_master_t postfix_spool_bounce_t:dir manage_dir_perms;
|
|
|
c70f043 |
allow postfix_master_t postfix_spool_bounce_t:file getattr_file_perms;
|
|
|
c70f043 |
|
|
|
c70f043 |
manage_dirs_pattern(postfix_master_t, postfix_spool_flush_t, postfix_spool_flush_t)
|
|
|
c70f043 |
manage_files_pattern(postfix_master_t, postfix_spool_flush_t, postfix_spool_flush_t)
|
|
|
c70f043 |
manage_lnk_files_pattern(postfix_master_t, postfix_spool_flush_t, postfix_spool_flush_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
delete_files_pattern(postfix_master_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
|
|
|
c70f043 |
rename_files_pattern(postfix_master_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
|
|
|
c70f043 |
rw_files_pattern(postfix_master_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
|
|
|
c70f043 |
setattr_dirs_pattern(postfix_master_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
kernel_read_all_sysctls(postfix_master_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
corenet_all_recvfrom_netlabel(postfix_master_t)
|
|
|
c70f043 |
corenet_tcp_sendrecv_generic_if(postfix_master_t)
|
|
|
c70f043 |
corenet_udp_sendrecv_generic_if(postfix_master_t)
|
|
|
c70f043 |
corenet_tcp_sendrecv_generic_node(postfix_master_t)
|
|
|
c70f043 |
corenet_udp_sendrecv_generic_node(postfix_master_t)
|
|
|
c70f043 |
corenet_tcp_sendrecv_all_ports(postfix_master_t)
|
|
|
c70f043 |
corenet_udp_sendrecv_all_ports(postfix_master_t)
|
|
|
c70f043 |
corenet_udp_bind_generic_node(postfix_master_t)
|
|
|
c70f043 |
corenet_udp_bind_all_unreserved_ports(postfix_master_t)
|
|
|
c70f043 |
corenet_dontaudit_udp_bind_all_ports(postfix_master_t)
|
|
|
c70f043 |
corenet_tcp_bind_generic_node(postfix_master_t)
|
|
|
c70f043 |
corenet_tcp_bind_amavisd_send_port(postfix_master_t)
|
|
|
c70f043 |
corenet_tcp_bind_smtp_port(postfix_master_t)
|
|
|
c70f043 |
corenet_tcp_connect_all_ports(postfix_master_t)
|
|
|
c70f043 |
corenet_sendrecv_amavisd_send_server_packets(postfix_master_t)
|
|
|
c70f043 |
corenet_sendrecv_smtp_server_packets(postfix_master_t)
|
|
|
c70f043 |
corenet_sendrecv_all_client_packets(postfix_master_t)
|
|
|
c70f043 |
# for spampd
|
|
|
c70f043 |
corenet_tcp_bind_spamd_port(postfix_master_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
# for a find command
|
|
|
c70f043 |
selinux_dontaudit_search_fs(postfix_master_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
corecmd_exec_shell(postfix_master_t)
|
|
|
c70f043 |
corecmd_exec_bin(postfix_master_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
domain_use_interactive_fds(postfix_master_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
files_search_var_lib(postfix_master_t)
|
|
|
c70f043 |
files_search_tmp(postfix_master_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
term_dontaudit_search_ptys(postfix_master_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
seutil_sigchld_newrole(postfix_master_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
mta_rw_aliases(postfix_master_t)
|
|
|
c70f043 |
mta_read_sendmail_bin(postfix_master_t)
|
|
|
c70f043 |
mta_getattr_spool(postfix_master_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
ifdef(`distro_redhat',`
|
|
|
c70f043 |
# for newer main.cf that uses /etc/aliases
|
|
|
c70f043 |
mta_manage_aliases(postfix_master_t)
|
|
|
c70f043 |
mta_etc_filetrans_aliases(postfix_master_t)
|
|
|
c70f043 |
')
|
|
|
c70f043 |
|
|
|
c70f043 |
optional_policy(`
|
|
|
c70f043 |
cyrus_stream_connect(postfix_master_t)
|
|
|
c70f043 |
')
|
|
|
c70f043 |
|
|
|
c70f043 |
optional_policy(`
|
|
|
c70f043 |
kerberos_keytab_template(postfix, postfix_t)
|
|
|
c70f043 |
')
|
|
|
c70f043 |
|
|
|
c70f043 |
optional_policy(`
|
|
|
c70f043 |
# for postalias
|
|
|
c70f043 |
mailman_manage_data_files(postfix_master_t)
|
|
|
c70f043 |
')
|
|
|
c70f043 |
|
|
|
c70f043 |
optional_policy(`
|
|
|
c70f043 |
postgrey_search_spool(postfix_master_t)
|
|
|
c70f043 |
')
|
|
|
c70f043 |
|
|
|
c70f043 |
optional_policy(`
|
|
|
c70f043 |
sendmail_signal(postfix_master_t)
|
|
|
c70f043 |
')
|
|
|
c70f043 |
|
|
|
c70f043 |
########################################
|
|
|
c70f043 |
#
|
|
|
c70f043 |
# Postfix bounce local policy
|
|
|
c70f043 |
#
|
|
|
c70f043 |
|
|
|
c70f043 |
allow postfix_bounce_t self:capability dac_read_search;
|
|
|
c70f043 |
allow postfix_bounce_t self:tcp_socket create_socket_perms;
|
|
|
c70f043 |
|
|
|
c70f043 |
allow postfix_bounce_t postfix_public_t:sock_file write;
|
|
|
c70f043 |
allow postfix_bounce_t postfix_public_t:dir search_dir_perms;
|
|
|
c70f043 |
|
|
|
c70f043 |
manage_dirs_pattern(postfix_bounce_t, postfix_spool_t, postfix_spool_t)
|
|
|
c70f043 |
manage_files_pattern(postfix_bounce_t, postfix_spool_t, postfix_spool_t)
|
|
|
c70f043 |
manage_lnk_files_pattern(postfix_bounce_t, postfix_spool_t, postfix_spool_t)
|
|
|
c70f043 |
files_spool_filetrans(postfix_bounce_t, postfix_spool_t, dir)
|
|
|
c70f043 |
|
|
|
c70f043 |
manage_files_pattern(postfix_bounce_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
|
|
|
c70f043 |
manage_dirs_pattern(postfix_bounce_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
|
|
|
c70f043 |
allow postfix_bounce_t postfix_spool_maildrop_t:lnk_file read_lnk_file_perms;
|
|
|
c70f043 |
|
|
|
c70f043 |
manage_dirs_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool_bounce_t)
|
|
|
c70f043 |
manage_files_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool_bounce_t)
|
|
|
c70f043 |
manage_lnk_files_pattern(postfix_bounce_t, postfix_spool_bounce_t, postfix_spool_bounce_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
########################################
|
|
|
c70f043 |
#
|
|
|
c70f043 |
# Postfix cleanup local policy
|
|
|
c70f043 |
#
|
|
|
c70f043 |
|
|
|
c70f043 |
allow postfix_cleanup_t self:process setrlimit;
|
|
|
c70f043 |
allow postfix_cleanup_t postfix_smtpd_t:tcp_socket rw_stream_socket_perms;
|
|
|
c70f043 |
|
|
|
c70f043 |
# connect to master process
|
|
|
c70f043 |
stream_connect_pattern(postfix_cleanup_t, postfix_private_t, postfix_private_t, postfix_master_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
rw_fifo_files_pattern(postfix_cleanup_t, postfix_public_t, postfix_public_t)
|
|
|
c70f043 |
write_sock_files_pattern(postfix_cleanup_t, postfix_public_t, postfix_public_t)
|
|
|
c70f043 |
allow postfix_cleanup_t postfix_smtpd_t:unix_stream_socket rw_socket_perms;
|
|
|
c70f043 |
|
|
|
c70f043 |
manage_dirs_pattern(postfix_cleanup_t, postfix_spool_t, postfix_spool_t)
|
|
|
c70f043 |
manage_files_pattern(postfix_cleanup_t, postfix_spool_t, postfix_spool_t)
|
|
|
c70f043 |
manage_lnk_files_pattern(postfix_cleanup_t, postfix_spool_t, postfix_spool_t)
|
|
|
c70f043 |
files_spool_filetrans(postfix_cleanup_t, postfix_spool_t, dir)
|
|
|
c70f043 |
|
|
|
c70f043 |
allow postfix_cleanup_t postfix_spool_maildrop_t:dir list_dir_perms;
|
|
|
c70f043 |
allow postfix_cleanup_t postfix_spool_maildrop_t:file read_file_perms;
|
|
|
c70f043 |
allow postfix_cleanup_t postfix_spool_maildrop_t:lnk_file read_lnk_file_perms;
|
|
|
c70f043 |
|
|
|
c70f043 |
allow postfix_cleanup_t postfix_spool_bounce_t:dir list_dir_perms;
|
|
|
c70f043 |
|
|
|
c70f043 |
corecmd_exec_bin(postfix_cleanup_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
# allow postfix to connect to sqlgrey
|
|
|
c70f043 |
corenet_tcp_connect_rtsclient_port(postfix_cleanup_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
mta_read_aliases(postfix_cleanup_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
optional_policy(`
|
|
|
c70f043 |
mailman_read_data_files(postfix_cleanup_t)
|
|
|
c70f043 |
')
|
|
|
c70f043 |
|
|
|
c70f043 |
########################################
|
|
|
c70f043 |
#
|
|
|
c70f043 |
# Postfix local local policy
|
|
|
c70f043 |
#
|
|
|
c70f043 |
|
|
|
c70f043 |
allow postfix_local_t self:process { setsched setrlimit };
|
|
|
c70f043 |
|
|
|
c70f043 |
# connect to master process
|
|
|
c70f043 |
stream_connect_pattern(postfix_local_t, postfix_public_t, postfix_public_t, postfix_master_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
# for .forward - maybe we need a new type for it?
|
|
|
c70f043 |
rw_sock_files_pattern(postfix_local_t, postfix_private_t, postfix_private_t)
|
|
|
c70f043 |
rw_files_pattern(postfix_local_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
domtrans_pattern(postfix_local_t, postfix_postdrop_exec_t, postfix_postdrop_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
allow postfix_local_t postfix_spool_t:file rw_file_perms;
|
|
|
c70f043 |
|
|
|
c70f043 |
corecmd_exec_shell(postfix_local_t)
|
|
|
c70f043 |
corecmd_exec_bin(postfix_local_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
logging_dontaudit_search_logs(postfix_local_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
mta_read_aliases(postfix_local_t)
|
|
|
c70f043 |
mta_delete_spool(postfix_local_t)
|
|
|
c70f043 |
# For reading spamassasin
|
|
|
c70f043 |
mta_read_config(postfix_local_t)
|
|
|
c70f043 |
# Handle vacation script
|
|
|
c70f043 |
mta_send_mail(postfix_local_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
userdom_read_user_home_content_files(postfix_local_t)
|
|
|
c70f043 |
userdom_exec_user_bin_files(postfix_local_t)
|
|
|
c70f043 |
|
|
|
c70f043 |
tunable_policy(`use_nfs_home_dirs',`
|
|
|
c70f043 |
fs_exec_nfs_files(postfix_local_t)
|
|
|
c70f043 |
')
|
|
|
c70f043 |
|
|
|
c70f043 |
tunable_policy(`use_samba_home_dirs',`
|
|
|
c70f043 |
fs_exec_cifs_files(postfix_local_t)
|
|
|
c70f043 |
')
|
|
|
c70f043 |
|
|
|
c70f043 |
tunable_policy(`postfix_local_write_mail_spool',`
|
|
|
c70f043 |
mta_manage_spool(postfix_local_t)
|
|
|
c70f043 |
')
|
|
|
c70f043 |
|
|
|
c70f043 |
optional_policy(`
|
|
|
c70f043 |
clamav_search_lib(postfix_local_t)
|
|
|
c70f043 |
clamav_exec_clamscan(postfix_local_t)
|
|
|
c70f043 |
clamav_stream_connect(postfix_domain)
|
|
|
c70f043 |
')
|
|
|
c70f043 |
|
|
|
c70f043 |
optional_policy(`
|
|
|
c70f043 |
dovecot_domtrans_deliver(postfix_local_t)
|
|
|
c70f043 |
')
|
|
|
c70f043 |
|
|
|
c70f043 |
optional_policy(`
|
|
|
c70f043 |
dspam_domtrans(postfix_local_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
# for postalias
|
|
|
1ec3d1a |
mailman_manage_data_files(postfix_local_t)
|
|
|
1ec3d1a |
mailman_append_log(postfix_local_t)
|
|
|
1ec3d1a |
mailman_read_log(postfix_local_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
nagios_search_spool(postfix_local_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
270da9d |
openshift_search_lib(postfix_local_t)
|
|
|
270da9d |
')
|
|
|
270da9d |
|
|
|
270da9d |
optional_policy(`
|
|
|
1ec3d1a |
procmail_domtrans(postfix_local_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
sendmail_rw_pipes(postfix_local_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
zarafa_domtrans_deliver(postfix_local_t)
|
|
|
1ec3d1a |
zarafa_stream_connect_server(postfix_local_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Postfix map local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
allow postfix_map_t self:capability { dac_override setgid setuid };
|
|
|
1ec3d1a |
allow postfix_map_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
1ec3d1a |
allow postfix_map_t self:unix_dgram_socket create_socket_perms;
|
|
|
1ec3d1a |
allow postfix_map_t self:tcp_socket create_stream_socket_perms;
|
|
|
1ec3d1a |
allow postfix_map_t self:udp_socket create_socket_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_dirs_pattern(postfix_map_t, postfix_etc_t, postfix_etc_t)
|
|
|
1ec3d1a |
manage_files_pattern(postfix_map_t, postfix_etc_t, postfix_etc_t)
|
|
|
1ec3d1a |
manage_lnk_files_pattern(postfix_map_t, postfix_etc_t, postfix_etc_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_dirs_pattern(postfix_map_t, postfix_map_tmp_t, postfix_map_tmp_t)
|
|
|
1ec3d1a |
manage_files_pattern(postfix_map_t, postfix_map_tmp_t, postfix_map_tmp_t)
|
|
|
1ec3d1a |
files_tmp_filetrans(postfix_map_t, postfix_map_tmp_t, { file dir })
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
kernel_read_kernel_sysctls(postfix_map_t)
|
|
|
1ec3d1a |
kernel_dontaudit_list_proc(postfix_map_t)
|
|
|
1ec3d1a |
kernel_dontaudit_read_system_state(postfix_map_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corenet_all_recvfrom_netlabel(postfix_map_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_generic_if(postfix_map_t)
|
|
|
1ec3d1a |
corenet_udp_sendrecv_generic_if(postfix_map_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_generic_node(postfix_map_t)
|
|
|
1ec3d1a |
corenet_udp_sendrecv_generic_node(postfix_map_t)
|
|
|
1ec3d1a |
corenet_tcp_sendrecv_all_ports(postfix_map_t)
|
|
|
1ec3d1a |
corenet_udp_sendrecv_all_ports(postfix_map_t)
|
|
|
1ec3d1a |
corenet_tcp_connect_all_ports(postfix_map_t)
|
|
|
1ec3d1a |
corenet_sendrecv_all_client_packets(postfix_map_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corecmd_list_bin(postfix_map_t)
|
|
|
1ec3d1a |
corecmd_read_bin_symlinks(postfix_map_t)
|
|
|
1ec3d1a |
corecmd_read_bin_files(postfix_map_t)
|
|
|
1ec3d1a |
corecmd_read_bin_pipes(postfix_map_t)
|
|
|
1ec3d1a |
corecmd_read_bin_sockets(postfix_map_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
files_list_home(postfix_map_t)
|
|
|
1ec3d1a |
files_read_etc_runtime_files(postfix_map_t)
|
|
|
1ec3d1a |
files_dontaudit_search_var(postfix_map_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
auth_use_nsswitch(postfix_map_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
logging_send_syslog_msg(postfix_map_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
locallogin_dontaudit_use_fds(postfix_map_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
# for postalias
|
|
|
1ec3d1a |
mailman_manage_data_files(postfix_map_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Postfix pickup local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_pickup_t self:tcp_socket create_socket_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
stream_connect_pattern(postfix_pickup_t, postfix_private_t, postfix_private_t, postfix_master_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
rw_fifo_files_pattern(postfix_pickup_t, postfix_public_t, postfix_public_t)
|
|
|
1ec3d1a |
rw_sock_files_pattern(postfix_pickup_t, postfix_public_t, postfix_public_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_pickup_t postfix_spool_t:dir list_dir_perms;
|
|
|
1ec3d1a |
read_files_pattern(postfix_pickup_t, postfix_spool_t, postfix_spool_t)
|
|
|
1ec3d1a |
delete_files_pattern(postfix_pickup_t, postfix_spool_t, postfix_spool_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
postfix_list_spool(postfix_pickup_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_pickup_t postfix_spool_maildrop_t:dir list_dir_perms;
|
|
|
1ec3d1a |
read_files_pattern(postfix_pickup_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
|
|
|
1ec3d1a |
delete_files_pattern(postfix_pickup_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Postfix pipe local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_pipe_t self:process setrlimit;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
write_sock_files_pattern(postfix_pipe_t, postfix_private_t, postfix_private_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
write_fifo_files_pattern(postfix_pipe_t, postfix_public_t, postfix_public_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
rw_files_pattern(postfix_pipe_t, postfix_spool_t, postfix_spool_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
domtrans_pattern(postfix_pipe_t, postfix_postdrop_exec_t, postfix_postdrop_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corecmd_exec_bin(postfix_pipe_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
dovecot_domtrans_deliver(postfix_pipe_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
procmail_domtrans(postfix_pipe_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
mailman_domtrans_queue(postfix_pipe_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
mta_manage_spool(postfix_pipe_t)
|
|
|
1ec3d1a |
mta_send_mail(postfix_pipe_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
spamassassin_domtrans_client(postfix_pipe_t)
|
|
|
1ec3d1a |
spamassassin_kill_client(postfix_pipe_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
uucp_domtrans_uux(postfix_pipe_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Postfix postdrop local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# usually it does not need a UDP socket
|
|
|
1ec3d1a |
allow postfix_postdrop_t self:capability sys_resource;
|
|
|
1ec3d1a |
allow postfix_postdrop_t self:tcp_socket create;
|
|
|
1ec3d1a |
allow postfix_postdrop_t self:udp_socket create_socket_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# Might be a leak, but I need a postfix expert to explain
|
|
|
1ec3d1a |
allow postfix_postdrop_t postfix_local_t:unix_stream_socket { read write };
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
rw_fifo_files_pattern(postfix_postdrop_t, postfix_public_t, postfix_public_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
postfix_list_spool(postfix_postdrop_t)
|
|
|
1ec3d1a |
manage_files_pattern(postfix_postdrop_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corenet_udp_sendrecv_generic_if(postfix_postdrop_t)
|
|
|
1ec3d1a |
corenet_udp_sendrecv_generic_node(postfix_postdrop_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
term_dontaudit_use_all_ptys(postfix_postdrop_t)
|
|
|
1ec3d1a |
term_dontaudit_use_all_ttys(postfix_postdrop_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
mta_rw_user_mail_stream_sockets(postfix_postdrop_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
apache_dontaudit_rw_fifo_file(postfix_postdrop_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
cron_system_entry(postfix_postdrop_t, postfix_postdrop_exec_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239951
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
fstools_read_pipes(postfix_postdrop_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
sendmail_rw_unix_stream_sockets(postfix_postdrop_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
uucp_manage_spool(postfix_postdrop_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
#######################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Postfix postqueue local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_postqueue_t self:tcp_socket create;
|
|
|
1ec3d1a |
allow postfix_postqueue_t self:udp_socket { create ioctl };
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# wants to write to /var/spool/postfix/public/showq
|
|
|
1ec3d1a |
stream_connect_pattern(postfix_postqueue_t, postfix_public_t, postfix_public_t, postfix_master_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# write to /var/spool/postfix/public/qmgr
|
|
|
1ec3d1a |
write_fifo_files_pattern(postfix_postqueue_t, postfix_public_t, postfix_public_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
domtrans_pattern(postfix_postqueue_t, postfix_showq_exec_t, postfix_showq_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# to write the mailq output, it really should not need read access!
|
|
|
1ec3d1a |
term_use_all_inherited_ptys(postfix_postqueue_t)
|
|
|
1ec3d1a |
term_use_all_inherited_ttys(postfix_postqueue_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
init_sigchld_script(postfix_postqueue_t)
|
|
|
1ec3d1a |
init_use_script_fds(postfix_postqueue_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
cron_system_entry(postfix_postqueue_t, postfix_postqueue_exec_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
ppp_use_fds(postfix_postqueue_t)
|
|
|
1ec3d1a |
ppp_sigchld(postfix_postqueue_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Postfix qmgr local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
stream_connect_pattern(postfix_qmgr_t, { postfix_private_t postfix_public_t }, { postfix_private_t postfix_public_t }, postfix_master_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
rw_fifo_files_pattern(postfix_qmgr_t, postfix_public_t, postfix_public_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# for /var/spool/postfix/active
|
|
|
1ec3d1a |
manage_dirs_pattern(postfix_qmgr_t, postfix_spool_t, postfix_spool_t)
|
|
|
1ec3d1a |
manage_files_pattern(postfix_qmgr_t, postfix_spool_t, postfix_spool_t)
|
|
|
1ec3d1a |
manage_lnk_files_pattern(postfix_qmgr_t, postfix_spool_t, postfix_spool_t)
|
|
|
1ec3d1a |
files_spool_filetrans(postfix_qmgr_t, postfix_spool_t, dir)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_qmgr_t postfix_spool_bounce_t:dir list_dir_perms;
|
|
|
1ec3d1a |
allow postfix_qmgr_t postfix_spool_bounce_t:file read_file_perms;
|
|
|
1ec3d1a |
allow postfix_qmgr_t postfix_spool_bounce_t:lnk_file read_lnk_file_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_files_pattern(postfix_qmgr_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
|
|
|
1ec3d1a |
manage_dirs_pattern(postfix_qmgr_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
|
|
|
1ec3d1a |
allow postfix_qmgr_t postfix_spool_maildrop_t:lnk_file read_lnk_file_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corecmd_exec_bin(postfix_qmgr_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Postfix showq local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_showq_t self:capability { setuid setgid };
|
|
|
1ec3d1a |
allow postfix_showq_t self:tcp_socket create_socket_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_showq_t postfix_master_t:unix_stream_socket { accept rw_socket_perms };
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_showq_t postfix_spool_t:file read_file_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
postfix_list_spool(postfix_showq_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_showq_t postfix_spool_maildrop_t:dir list_dir_perms;
|
|
|
1ec3d1a |
allow postfix_showq_t postfix_spool_maildrop_t:file read_file_perms;
|
|
|
1ec3d1a |
allow postfix_showq_t postfix_spool_maildrop_t:lnk_file read_lnk_file_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# to write the mailq output, it really should not need read access!
|
|
|
1ec3d1a |
term_use_all_ptys(postfix_showq_t)
|
|
|
1ec3d1a |
term_use_all_ttys(postfix_showq_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Postfix smtp delivery local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# connect to master process
|
|
|
1ec3d1a |
allow postfix_smtp_t self:capability sys_chroot;
|
|
|
1ec3d1a |
stream_connect_pattern(postfix_smtp_t, { postfix_private_t postfix_public_t }, { postfix_private_t postfix_public_t }, postfix_master_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_smtp_t postfix_prng_t:file rw_file_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_smtp_t postfix_spool_t:file rw_file_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
rw_files_pattern(postfix_smtp_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
|
|
|
1ec3d1a |
|
|
|
a66e8d8 |
# for spampd
|
|
|
a66e8d8 |
corenet_tcp_connect_spamd_port(postfix_master_t)
|
|
|
a66e8d8 |
|
|
|
1ec3d1a |
files_search_all_mountpoints(postfix_smtp_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
cyrus_stream_connect(postfix_smtp_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
c70f043 |
dovecot_stream_connect(postfix_smtp_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
dspam_stream_connect(postfix_smtp_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
milter_stream_connect_all(postfix_smtp_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Postfix smtpd local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
allow postfix_smtpd_t postfix_master_t:tcp_socket rw_stream_socket_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# connect to master process
|
|
|
1ec3d1a |
stream_connect_pattern(postfix_smtpd_t, { postfix_private_t postfix_public_t }, { postfix_private_t postfix_public_t }, postfix_master_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# Connect to policy server
|
|
|
1ec3d1a |
corenet_tcp_connect_postfix_policyd_port(postfix_smtpd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# for prng_exch
|
|
|
1ec3d1a |
manage_dirs_pattern(postfix_smtpd_t, postfix_spool_t, postfix_spool_t)
|
|
|
1ec3d1a |
manage_files_pattern(postfix_smtpd_t, postfix_spool_t, postfix_spool_t)
|
|
|
1ec3d1a |
manage_lnk_files_pattern(postfix_smtpd_t, postfix_spool_t, postfix_spool_t)
|
|
|
1ec3d1a |
allow postfix_smtpd_t postfix_prng_t:file rw_file_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corecmd_exec_bin(postfix_smtpd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# for OpenSSL certificates
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# postfix checks the size of all mounted file systems
|
|
|
1ec3d1a |
fs_getattr_all_dirs(postfix_smtpd_t)
|
|
|
1ec3d1a |
fs_getattr_all_fs(postfix_smtpd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
mta_read_aliases(postfix_smtpd_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
dovecot_stream_connect_auth(postfix_smtpd_t)
|
|
|
1ec3d1a |
dovecot_stream_connect(postfix_smtpd_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
mailman_read_data_files(postfix_smtpd_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
milter_stream_connect_all(postfix_smtpd_t)
|
|
|
1ec3d1a |
spamassassin_read_pid_files(postfix_smtpd_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
postgrey_stream_connect(postfix_smtpd_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
1ec3d1a |
sasl_connect(postfix_smtpd_t)
|
|
|
1ec3d1a |
')
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Postfix virtual local policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_virtual_t self:process { setsched setrlimit };
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_virtual_t postfix_spool_t:file rw_file_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
# connect to master process
|
|
|
1ec3d1a |
stream_connect_pattern(postfix_virtual_t, { postfix_private_t postfix_public_t }, { postfix_private_t postfix_public_t }, postfix_master_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corecmd_exec_shell(postfix_virtual_t)
|
|
|
1ec3d1a |
corecmd_exec_bin(postfix_virtual_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
mta_read_aliases(postfix_virtual_t)
|
|
|
1ec3d1a |
mta_delete_spool(postfix_virtual_t)
|
|
|
1ec3d1a |
# For reading spamassasin
|
|
|
1ec3d1a |
mta_read_config(postfix_virtual_t)
|
|
|
1ec3d1a |
mta_manage_spool(postfix_virtual_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
userdom_manage_user_home_dirs(postfix_virtual_t)
|
|
|
1ec3d1a |
userdom_manage_user_home_content(postfix_virtual_t)
|
|
|
1ec3d1a |
userdom_home_filetrans_user_home_dir(postfix_virtual_t)
|
|
|
1ec3d1a |
userdom_user_home_dir_filetrans_user_home_content(postfix_virtual_t, {file dir })
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# postfix_domain common policy
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
allow postfix_domain self:capability { sys_nice sys_chroot };
|
|
|
1ec3d1a |
dontaudit postfix_domain self:capability sys_tty_config;
|
|
|
1ec3d1a |
allow postfix_domain self:process { signal_perms setpgid setsched };
|
|
|
1ec3d1a |
allow postfix_domain self:unix_dgram_socket create_socket_perms;
|
|
|
1ec3d1a |
allow postfix_domain self:unix_stream_socket create_stream_socket_perms;
|
|
|
1ec3d1a |
allow postfix_domain self:unix_stream_socket connectto;
|
|
|
1ec3d1a |
allow postfix_domain self:fifo_file rw_fifo_file_perms;
|
|
|
1ec3d1a |
|
|
|
e6cf3c6 |
allow postfix_master_t postfix_domain:fifo_file { read write };
|
|
|
1ec3d1a |
allow postfix_master_t postfix_domain:process signal;
|
|
|
1ec3d1a |
#https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=244456
|
|
|
1ec3d1a |
allow postfix_domain postfix_master_t:file read;
|
|
|
1ec3d1a |
allow postfix_domain postfix_etc_t:dir list_dir_perms;
|
|
|
1ec3d1a |
read_files_pattern(postfix_domain, postfix_etc_t, postfix_etc_t)
|
|
|
1ec3d1a |
read_lnk_files_pattern(postfix_domain, postfix_etc_t, postfix_etc_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_domain postfix_exec_t:file { mmap_file_perms lock };
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_domain postfix_master_t:process sigchld;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_domain postfix_spool_t:dir list_dir_perms;
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
allow postfix_domain postfix_var_run_t:file manage_file_perms;
|
|
|
1ec3d1a |
files_pid_filetrans(postfix_domain, postfix_var_run_t, file)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
kernel_read_network_state(postfix_domain)
|
|
|
1ec3d1a |
kernel_read_all_sysctls(postfix_domain)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
dev_read_sysfs(postfix_domain)
|
|
|
1ec3d1a |
dev_read_rand(postfix_domain)
|
|
|
1ec3d1a |
dev_read_urand(postfix_domain)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
fs_search_auto_mountpoints(postfix_domain)
|
|
|
1ec3d1a |
fs_getattr_xattr_fs(postfix_domain)
|
|
|
1ec3d1a |
fs_rw_anon_inodefs_files(postfix_domain)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
term_dontaudit_use_console(postfix_domain)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
corecmd_exec_shell(postfix_domain)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
files_read_etc_runtime_files(postfix_domain)
|
|
|
1ec3d1a |
files_read_usr_symlinks(postfix_domain)
|
|
|
1ec3d1a |
files_search_spool(postfix_domain)
|
|
|
b5360e1 |
files_list_tmp(postfix_domain)
|
|
|
1ec3d1a |
files_search_all_mountpoints(postfix_domain)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
init_dontaudit_use_fds(postfix_domain)
|
|
|
1ec3d1a |
init_sigchld(postfix_domain)
|
|
|
1ec3d1a |
init_dontaudit_rw_stream_socket(postfix_domain)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
miscfiles_read_generic_certs(postfix_domain)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
userdom_dontaudit_use_unpriv_user_fds(postfix_domain)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
optional_policy(`
|
|
|
d3b3143 |
mysql_stream_connect(postfix_domain)
|
|
|
d3b3143 |
')
|
|
|
d3b3143 |
|
|
|
d3b3143 |
optional_policy(`
|
|
|
618e864 |
spamd_stream_connect(postfix_domain)
|
|
|
0fd9290 |
spamassassin_domtrans_client(postfix_domain)
|
|
|
618e864 |
')
|
|
|
618e864 |
|
|
|
618e864 |
optional_policy(`
|
|
|
1ec3d1a |
udev_read_db(postfix_domain)
|
|
|
1ec3d1a |
')
|