postfix mysql

[Antoine Martin <antoine@nagafix.co.uk>]

Based on a similar policy update, I guess that what I have been adding
to the postfix policy to enable it to use the mysql backend could be
achieved with a boolean and merged upsteam?


ifdef(`mysqld.te', `
tunable_policy(`postfix_can_network_connect_db',`
can_unix_connect(postfix_smtpd_t, mysqld_t)
allow postfix_smtpd_t mysqld_var_run_t:dir { search };
allow postfix_smtpd_t mysqld_var_run_t:sock_file { write };

can_unix_connect(postfix_pipe_t, mysqld_t)
allow postfix_pipe_t mysqld_var_run_t:dir { search };
allow postfix_pipe_t mysqld_var_run_t:sock_file { write };

can_unix_connect(postfix_master_t, mysqld_t)
allow postfix_master_t mysqld_var_run_t:dir { search };
allow postfix_master_t mysqld_var_run_t:sock_file { write };

can_unix_connect(postfix_cleanup_t, mysqld_t)
allow postfix_cleanup_t mysqld_var_run_t:dir { search };
allow postfix_cleanup_t mysqld_var_run_t:sock_file { write };

can_unix_connect(postfix_postdrop_t, mysqld_t)
allow postfix_postdrop_t mysqld_var_run_t:dir { search };
allow postfix_postdrop_t mysqld_var_run_t:sock_file { write };
')
# Why postfix_cleanup/postdrop needs access to this charset file?
(/usr/share/mysql/charsets/Index)
# beats me:
allow postfix_cleanup_t usr_t:file { getattr read };
allow postfix_postdrop_t usr_t:file { getattr read };
 ')
')


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.