* qmail policy
@ 2006-04-04 16:50 Petre Rodan
2006-04-05 15:38 ` Christopher J. PeBenito
0 siblings, 1 reply; 2+ messages in thread
From: Petre Rodan @ 2006-04-04 16:50 UTC (permalink / raw)
To: SELinux List
[-- Attachment #1.1: Type: text/plain, Size: 333 bytes --]
Hi,
attached you'll find the qmail policy and a small patch needed to integrate it into serefpol.
the qmail_smtpd_service_domain and qmail_queue_domtrans interfaces will be used at a later date by antivirus or antispam filters.
cheers,
peter
--
petre rodan
<kaiowas@gentoo.org>
Developer,
Hardened Gentoo Linux
[-- Attachment #1.2: qmail.fc --]
[-- Type: text/plain, Size: 2708 bytes --]
/var/qmail/alias -d gen_context(system_u:object_r:qmail_alias_home_t,s0)
/var/qmail/alias(/.*)? gen_context(system_u:object_r:qmail_alias_home_t,s0)
/var/qmail/bin/qmail-clean -- gen_context(system_u:object_r:qmail_clean_exec_t,s0)
/var/qmail/bin/qmail-getpw -- gen_context(system_u:object_r:qmail_exec_t,s0)
/var/qmail/bin/qmail-inject -- gen_context(system_u:object_r:qmail_inject_exec_t,s0)
/var/qmail/bin/qmail-local -- gen_context(system_u:object_r:qmail_local_exec_t,s0)
/var/qmail/bin/qmail-lspawn -- gen_context(system_u:object_r:qmail_lspawn_exec_t,s0)
/var/qmail/bin/qmail-queue -- gen_context(system_u:object_r:qmail_queue_exec_t,s0)
/var/qmail/bin/qmail-remote -- gen_context(system_u:object_r:qmail_remote_exec_t,s0)
/var/qmail/bin/qmail-rspawn -- gen_context(system_u:object_r:qmail_rspawn_exec_t,s0)
/var/qmail/bin/qmail-send -- gen_context(system_u:object_r:qmail_send_exec_t,s0)
/var/qmail/bin/qmail-smtpd -- gen_context(system_u:object_r:qmail_smtpd_exec_t,s0)
/var/qmail/bin/qmail-start -- gen_context(system_u:object_r:qmail_start_exec_t,s0)
/var/qmail/bin/splogger -- gen_context(system_u:object_r:qmail_splogger_exec_t,s0)
/var/qmail/bin/tcp-env -- gen_context(system_u:object_r:qmail_tcp_env_exec_t,s0)
/var/qmail/control(/.*)? gen_context(system_u:object_r:qmail_etc_t,s0)
/var/qmail/queue(/.*)? gen_context(system_u:object_r:qmail_spool_t,s0)
ifdef(`distro_debian', `
/etc/qmail(/.*)? gen_context(system_u:object_r:qmail_etc_t,s0)
/usr/bin/tcp-env -- gen_context(system_u:object_r:qmail_tcp_env_exec_t,s0)
/usr/local/bin/serialmail/.* -- gen_context(system_u:object_r:qmail_serialmail_exec_t,s0)
/usr/sbin/qmail-clean -- gen_context(system_u:object_r:qmail_clean_exec_t,s0)
/usr/sbin/qmail-getpw -- gen_context(system_u:object_r:qmail_exec_t,s0)
/usr/sbin/qmail-inject -- gen_context(system_u:object_r:qmail_inject_exec_t,s0)
/usr/sbin/qmail-local -- gen_context(system_u:object_r:qmail_local_exec_t,s0)
/usr/sbin/qmail-lspawn -- gen_context(system_u:object_r:qmail_lspawn_exec_t,s0)
/usr/sbin/qmail-queue -- gen_context(system_u:object_r:qmail_queue_exec_t,s0)
/usr/sbin/qmail-remote -- gen_context(system_u:object_r:qmail_remote_exec_t,s0)
/usr/sbin/qmail-rspawn -- gen_context(system_u:object_r:qmail_rspawn_exec_t,s0)
/usr/sbin/qmail-send -- gen_context(system_u:object_r:qmail_send_exec_t,s0)
/usr/sbin/qmail-smtpd -- gen_context(system_u:object_r:qmail_smtpd_exec_t,s0)
/usr/sbin/qmail-start -- gen_context(system_u:object_r:qmail_start_exec_t,s0)
/usr/sbin/splogger -- gen_context(system_u:object_r:qmail_splogger_exec_t,s0)
/var/qmail(/.*)? gen_context(system_u:object_r:qmail_etc_t,s0)
/var/spool/qmail(/.*)? gen_context(system_u:object_r:qmail_spool_t,s0)
')
[-- Attachment #1.3: qmail.if --]
[-- Type: text/plain, Size: 4482 bytes --]
## <summary>policy for qmail MTA</summary>
########################################
## <summary>
## Template for qmail parent/sub-domain pairs
## </summary>
## <param name="domain_prefix">
## <summary>
## The name of the child domain
## </summary>
## </param>
## <param name="domain">
## <summary>
## The name of the parent domain
## </summary>
## </param>
#
template(`qmail_child_domain_template', `
gen_require(`
type qmail_etc_t;
type qmail_start_t;
')
type $1_t;
domain_type($1_t)
type $1_exec_t;
domain_entry_file($1_t,$1_exec_t)
domain_auto_trans($2, $1_exec_t, $1_t)
role system_r types $1_t;
allow $1_t $2:fd use;
allow $1_t $2:fifo_file rw_file_perms;
allow $1_t $2:process sigchld;
allow $1_t self:process signal_perms;
allow $1_t qmail_etc_t:dir { getattr read search };
allow $1_t qmail_etc_t:file { getattr read };
allow $1_t qmail_etc_t:lnk_file { getattr read };
allow $1_t qmail_start_t:fd use;
kernel_list_proc($2)
kernel_read_proc_symlinks($2)
corecmd_search_bin($1_t)
files_search_var($1_t)
fs_getattr_xattr_fs($1_t)
libs_use_ld_so($1_t)
libs_use_shared_libs($1_t)
miscfiles_read_localization($1_t)
')
#######################################
## <summary>
## The per user domain template for qmail
## </summary>
## <desc>
## <p>
## This template is invoked automatically for each user, and
## generally does not need to be invoked directly
## by policy writers.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="user_domain">
## <summary>
## The type of the user domain.
## </summary>
## </param>
## <param name="user_role">
## <summary>
## The role associated with the user domain.
## </summary>
## </param>
#
template(`qmail_per_userdomain_template',`
gen_require(`
attribute qmail_user_domains;
type qmail_inject_t;
type qmail_queue_t;
')
role $3 types qmail_inject_t;
role $3 types qmail_queue_t;
qmail_inject_domtrans($1_t)
allow qmail_user_domains $2:process sigchld;
allow qmail_user_domains $2:fifo_file { write getattr };
allow qmail_user_domains $2:fd use;
')
########################################
## <summary>
## Transition to qmail_inject_t
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access
## </summary>
## </param>
#
interface(`qmail_inject_domtrans',`
gen_require(`
type qmail_inject_t;
type qmail_inject_exec_t;
')
domain_auto_trans($1, qmail_inject_exec_t, qmail_inject_t)
allow qmail_inject_t $1:fd use;
allow qmail_inject_t $1:fifo_file { read write };
allow qmail_inject_t $1:process sigchld;
')
########################################
## <summary>
## Transition to qmail_queue_t
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access
## </summary>
## </param>
#
interface(`qmail_queue_domtrans', `
gen_require(`
type qmail_queue_t;
type qmail_queue_exec_t;
')
domain_auto_trans($1, qmail_queue_exec_t, qmail_queue_t)
allow qmail_queue_t $1:fd use;
allow qmail_queue_t $1:fifo_file { read write };
allow qmail_queue_t $1:process sigchld;
')
########################################
## <summary>
## Read qmail configuration files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`qmail_read_config',`
gen_require(`
type qmail_etc_t;
')
allow $1 qmail_etc_t:dir { getattr read search };
allow $1 qmail_etc_t:file { getattr read };
allow $1 qmail_etc_t:lnk_file { getattr read };
')
########################################
## <summary>
## Define the specified domain as a qmail-smtp service.
## Needed by antivirus/antispam filters.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access
## </summary>
## </param>
## <param name="entrypoint">
## <summary>
## The type associated with the process program.
## </summary>
## </param>
#
interface(`qmail_smtpd_service_domain', `
gen_require(`
type qmail_smtpd_t;
')
domain_auto_trans(qmail_smtpd_t, $2, $1)
allow $1 qmail_smtpd_t:fd use;
allow $1 qmail_smtpd_t:fifo_file { read write };
allow $1 qmail_smtpd_t:process sigchld;
')
[-- Attachment #1.4: qmail.patch --]
[-- Type: text/plain, Size: 5901 bytes --]
Index: policy/modules/kernel/corecommands.fc
===================================================================
RCS file: /cvsroot/serefpolicy/refpolicy/policy/modules/kernel/corecommands.fc,v
retrieving revision 1.11
diff -u -B -r1.11 corecommands.fc
--- policy/modules/kernel/corecommands.fc 24 Mar 2006 21:44:38 -0000 1.11
+++ policy/modules/kernel/corecommands.fc 4 Apr 2006 16:36:38 -0000
@@ -164,6 +164,7 @@
ifdef(`distro_gentoo', `
/usr/.*-.*-linux-gnu/gcc-bin/.*(/.*)? gen_context(system_u:object_r:bin_t,s0)
+/usr/.*-.*-linux-gnu/binutils-bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
')
ifdef(`distro_redhat', `
@@ -224,3 +225,8 @@
ifdef(`distro_suse',`
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
')
+
+/var/qmail/bin -d gen_context(system_u:object_r:bin_t,s0)
+/var/qmail/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
+/var/qmail/rc -- gen_context(system_u:object_r:bin_t,s0)
+
Index: policy/modules/services/mta.fc
===================================================================
RCS file: /cvsroot/serefpolicy/refpolicy/policy/modules/services/mta.fc,v
retrieving revision 1.5
diff -u -B -r1.5 mta.fc
--- policy/modules/services/mta.fc 2 Feb 2006 21:12:27 -0000 1.5
+++ policy/modules/services/mta.fc 4 Apr 2006 16:36:38 -0000
@@ -12,6 +12,7 @@
/usr/sbin/sendmail.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0)
/usr/sbin/sendmail(.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0)
+/var/qmail/bin/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0)
/var/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0)
/var/spool/imap(/.*)? gen_context(system_u:object_r:mail_spool_t,s0)
Index: policy/modules/services/mta.if
===================================================================
RCS file: /cvsroot/serefpolicy/refpolicy/policy/modules/services/mta.if,v
retrieving revision 1.47
diff -u -B -r1.47 mta.if
--- policy/modules/services/mta.if 24 Mar 2006 16:15:50 -0000 1.47
+++ policy/modules/services/mta.if 4 Apr 2006 16:36:39 -0000
@@ -112,6 +112,10 @@
')
optional_policy(`
+ qmail_inject_domtrans($1_mail_t)
+ ')
+
+ optional_policy(`
gen_require(`
type etc_mail_t, mail_spool_t, mqueue_spool_t;
')
@@ -138,12 +142,6 @@
sendmail_create_log($1_mail_t)
')
- ifdef(`TODO',`
- ifdef(`qmail.te', `
- allow $1_mail_t qmail_etc_t:dir search;
- allow $1_mail_t qmail_etc_t:{ file lnk_file } read;
- ')
- ') dnl end TODO
')
#######################################
Index: policy/modules/services/mta.te
===================================================================
RCS file: /cvsroot/serefpolicy/refpolicy/policy/modules/services/mta.te,v
retrieving revision 1.42
diff -u -B -r1.42 mta.te
--- policy/modules/services/mta.te 24 Mar 2006 16:15:50 -0000 1.42
+++ policy/modules/services/mta.te 4 Apr 2006 16:36:39 -0000
@@ -162,6 +162,10 @@
')
optional_policy(`
+ qmail_inject_domtrans(system_mail_t)
+')
+
+optional_policy(`
userdom_dontaudit_use_unpriv_users_ptys(system_mail_t)
optional_policy(`
Index: policy/modules/services/ucspitcp.te
===================================================================
RCS file: /cvsroot/serefpolicy/refpolicy/policy/modules/services/ucspitcp.te,v
retrieving revision 1.2
diff -u -B -r1.2 ucspitcp.te
--- policy/modules/services/ucspitcp.te 24 Mar 2006 16:15:50 -0000 1.2
+++ policy/modules/services/ucspitcp.te 4 Apr 2006 16:36:39 -0000
@@ -56,6 +56,7 @@
allow ucspitcp_t self:fifo_file { read write };
allow ucspitcp_t self:process { fork sigchld };
allow ucspitcp_t self:tcp_socket create_stream_socket_perms;
+allow ucspitcp_t self:udp_socket create_stream_socket_perms;
corecmd_search_bin(ucspitcp_t)
corecmd_search_sbin(ucspitcp_t)
@@ -65,6 +66,7 @@
corenet_tcp_sendrecv_all_nodes(ucspitcp_t)
corenet_udp_sendrecv_all_nodes(ucspitcp_t)
corenet_tcp_sendrecv_all_ports(ucspitcp_t)
+corenet_udp_bind_inaddr_any_node(ucspitcp_t)
corenet_udp_sendrecv_all_ports(ucspitcp_t)
corenet_non_ipsec_sendrecv(ucspitcp_t)
corenet_tcp_bind_all_nodes(ucspitcp_t)
Index: policy/modules/system/daemontools.fc
===================================================================
RCS file: /cvsroot/serefpolicy/refpolicy/policy/modules/system/daemontools.fc,v
retrieving revision 1.1
diff -u -B -r1.1 daemontools.fc
--- policy/modules/system/daemontools.fc 16 Jan 2006 18:55:42 -0000 1.1
+++ policy/modules/system/daemontools.fc 4 Apr 2006 16:36:39 -0000
@@ -36,6 +36,10 @@
/var/dnscache/run -- gen_context(system_u:object_r:svc_run_exec_t,s0)
/var/dnscache/log/run -- gen_context(system_u:object_r:svc_run_exec_t,s0)
+/var/qmail/supervise(/.*)? gen_context(system_u:object_r:svc_svc_t,s0)
+/var/qmail/supervise/.*/run -- gen_context(system_u:object_r:svc_run_exec_t,s0)
+/var/qmail/supervise/.*/log/run -- gen_context(system_u:object_r:svc_run_exec_t,s0)
+
/var/service/.* gen_context(system_u:object_r:svc_svc_t,s0)
/var/service/.*/env(/.*)? gen_context(system_u:object_r:svc_conf_t,s0)
/var/service/.*/log/main(/.*)? gen_context(system_u:object_r:svc_log_t,s0)
Index: policy/modules/system/daemontools.te
===================================================================
RCS file: /cvsroot/serefpolicy/refpolicy/policy/modules/system/daemontools.te,v
retrieving revision 1.4
diff -u -B -r1.4 daemontools.te
--- policy/modules/system/daemontools.te 2 Mar 2006 23:45:56 -0000 1.4
+++ policy/modules/system/daemontools.te 4 Apr 2006 16:36:39 -0000
@@ -90,6 +90,10 @@
daemontools_domtrans_multilog(svc_run_t)
daemontools_read_svc(svc_run_t)
+optional_policy(`
+ qmail_read_config(svc_run_t)
+')
+
########################################
#
# local policy for service monitoring programs
[-- Attachment #1.5: qmail.te --]
[-- Type: text/plain, Size: 8199 bytes --]
policy_module(qmail,1.0.0)
########################################
#
# Declarations
#
attribute qmail_user_domains;
type qmail_alias_home_t;
files_type(qmail_alias_home_t)
type qmail_etc_t;
files_type(qmail_etc_t)
type qmail_exec_t;
files_type(qmail_exec_t)
type qmail_inject_t;
type qmail_inject_exec_t;
domain_type(qmail_inject_t)
domain_entry_file(qmail_inject_t,qmail_inject_exec_t)
role system_r types qmail_inject_t;
type qmail_spool_t;
files_type(qmail_spool_t)
type qmail_start_t;
type qmail_start_exec_t;
type qmail_tcp_env_t;
type qmail_tcp_env_exec_t;
type qmail_var_run_t;
files_type(qmail_var_run_t)
#######################################
#
# qmail-clean local policy
# this component cleans up the queue directory
qmail_child_domain_template(qmail_clean, qmail_start_t)
allow qmail_clean_t qmail_spool_t:dir rw_dir_perms;
allow qmail_clean_t qmail_spool_t:file { unlink read getattr };
########################################
#
# qmail-inject local policy
# this component preprocesses mail from stdin and invokes qmail-queue
typeattribute qmail_inject_t qmail_user_domains;
allow qmail_inject_t self:fifo_file { write };
allow qmail_inject_t self:process { fork signal_perms };
allow qmail_inject_t qmail_queue_exec_t:file read;
corecmd_search_bin(qmail_inject_t)
corecmd_search_sbin(qmail_inject_t)
files_search_var(qmail_inject_t)
libs_use_ld_so(qmail_inject_t)
libs_use_shared_libs(qmail_inject_t)
qmail_read_config(qmail_inject_t)
mta_mailserver_user_agent(qmail_inject_t)
########################################
#
# qmail-local local policy
# this component delivers a mail message
qmail_child_domain_template(qmail_local, qmail_lspawn_t)
qmail_queue_domtrans(qmail_local_t)
allow qmail_local_t qmail_alias_home_t:dir create_dir_perms;
allow qmail_local_t qmail_alias_home_t:file create_file_perms;
allow qmail_local_t qmail_queue_exec_t:file read;
allow qmail_local_t qmail_spool_t:file r_file_perms;
allow qmail_local_t self:fifo_file write;
allow qmail_local_t self:process { fork signal_perms };
allow qmail_local_t self:unix_stream_socket create_stream_socket_perms;
corecmd_exec_shell(qmail_local_t)
corecmd_search_sbin(qmail_local_t)
files_read_etc_files(qmail_local_t)
files_read_etc_runtime_files(qmail_local_t)
kernel_read_system_state(qmail_local_t)
mta_append_spool(qmail_local_t)
mta_mailserver_delivery(qmail_local_t)
########################################
#
# qmail-lspawn local policy
# this component schedules local deliveries
qmail_child_domain_template(qmail_lspawn, qmail_start_t)
allow qmail_lspawn_t self:capability { setuid setgid };
allow qmail_lspawn_t self:fifo_file { read write };
allow qmail_lspawn_t self:process { fork signal_perms };
allow qmail_lspawn_t self:unix_stream_socket create_socket_perms;
allow qmail_lspawn_t qmail_local_exec_t:file read;
allow qmail_lspawn_t qmail_spool_t:dir search;
allow qmail_lspawn_t qmail_spool_t:file { read getattr };
can_exec(qmail_lspawn_t, qmail_exec_t)
corecmd_search_sbin(qmail_lspawn_t)
files_read_etc_files(qmail_lspawn_t)
files_search_pids(qmail_lspawn_t)
files_search_tmp(qmail_lspawn_t)
mta_mailserver_delivery(qmail_lspawn_t)
########################################
#
# qmail-queue local policy
# this component places a mail in a delivery queue, later to be processed by qmail-send
qmail_child_domain_template(qmail_queue, qmail_inject_t)
typeattribute qmail_queue_t qmail_user_domains;
allow qmail_queue_t qmail_lspawn_t:fd use;
allow qmail_queue_t qmail_lspawn_t:fifo_file write;
allow qmail_queue_t qmail_smtpd_t:fd use;
allow qmail_queue_t qmail_smtpd_t:fifo_file read;
allow qmail_queue_t qmail_smtpd_t:process sigchld;
allow qmail_queue_t qmail_spool_t:dir create_dir_perms;
allow qmail_queue_t qmail_spool_t:fifo_file { read write };
allow qmail_queue_t qmail_spool_t:file create_file_perms;
mta_mailserver_user_agent(qmail_queue_t)
########################################
#
# qmail-remote local policy
# this component sends mail via SMTP
qmail_child_domain_template(qmail_remote, qmail_rspawn_t)
corenet_non_ipsec_sendrecv(qmail_remote_t)
corenet_tcp_sendrecv_generic_if(qmail_remote_t)
corenet_tcp_sendrecv_generic_node(qmail_remote_t)
corenet_tcp_sendrecv_smtp_port(qmail_remote_t)
corenet_udp_sendrecv_dns_port(qmail_remote_t)
corenet_udp_sendrecv_generic_if(qmail_remote_t)
corenet_udp_sendrecv_generic_node(qmail_remote_t)
allow qmail_remote_t qmail_spool_t:dir search;
allow qmail_remote_t qmail_spool_t:file rw_file_perms;
allow qmail_remote_t self:tcp_socket create_socket_perms;
allow qmail_remote_t self:udp_socket create_socket_perms;
allow qmail_remote_t smtp_port_t:tcp_socket name_connect;
dev_read_rand(qmail_remote_t)
dev_read_urand(qmail_remote_t)
mta_mailserver_sender(qmail_remote_t)
sysnet_read_config(qmail_remote_t)
########################################
#
# qmail-rspawn local policy
# this component scedules remote deliveries
qmail_child_domain_template(qmail_rspawn, qmail_start_t)
allow qmail_rspawn_t qmail_remote_exec_t:file read;
allow qmail_rspawn_t qmail_spool_t:dir search;
allow qmail_rspawn_t qmail_spool_t:file rw_file_perms;
allow qmail_rspawn_t self:process { fork signal_perms };
allow qmail_rspawn_t self:fifo_file read;
corecmd_search_bin(qmail_rspawn_t)
corecmd_search_sbin(qmail_rspawn_t)
########################################
#
# qmail-send local policy
# this component delivers mail messages from the queue
qmail_child_domain_template(qmail_send, qmail_start_t)
qmail_queue_domtrans(qmail_send_t)
allow qmail_send_t qmail_spool_t:dir create_dir_perms;
allow qmail_send_t qmail_spool_t:file create_file_perms;
allow qmail_send_t qmail_spool_t:fifo_file read;
allow qmail_send_t self:process { fork signal_perms };
allow qmail_send_t self:fifo_file write;
corecmd_search_sbin(qmail_send_t)
########################################
#
# qmail-smtpd local policy
# this component receives mails via SMTP
qmail_child_domain_template(qmail_smtpd, qmail_tcp_env_t)
qmail_queue_domtrans(qmail_smtpd_t)
# when controlled by tcpserver
optional_policy(`ucspitcp', `
ucspitcp_service_domain(qmail_smtpd_t, qmail_smtpd_exec_t)
')
allow qmail_smtpd_t self:process { fork signal_perms };
allow qmail_smtpd_t self:fifo_file write;
allow qmail_smtpd_t self:tcp_socket create_socket_perms;
allow qmail_smtpd_t qmail_queue_exec_t:file read;
corecmd_search_sbin(qmail_smtpd_t)
dev_read_rand(qmail_smtpd_t)
dev_read_urand(qmail_smtpd_t)
########################################
#
# splogger local policy
# this component creates entries in syslog
qmail_child_domain_template(qmail_splogger, qmail_start_t)
allow qmail_splogger_t self:unix_dgram_socket create_socket_perms;
files_read_etc_files(qmail_splogger_t)
miscfiles_read_localization(qmail_splogger_t)
dontaudit qmail_splogger_t initrc_t:fd use;
########################################
#
# qmail-start local policy
# this component starts up the mail delivery component
init_daemon_domain(qmail_start_t,qmail_start_exec_t)
allow qmail_start_t self:capability { setgid setuid };
allow qmail_start_t self:fifo_file { getattr read write };
allow qmail_start_t self:process signal_perms;
can_exec(qmail_start_t, qmail_start_exec_t)
corecmd_search_bin(qmail_start_t)
corecmd_search_sbin(qmail_start_t)
files_search_var(qmail_start_t)
libs_use_ld_so(qmail_start_t)
libs_use_shared_libs(qmail_start_t)
qmail_read_config(qmail_start_t)
optional_policy(`daemontools',`
daemontools_service_domain(qmail_start_t, qmail_start_exec_t)
daemontools_ipc_domain(qmail_send_t)
daemontools_ipc_domain(qmail_start_t)
daemontools_ipc_domain(qmail_queue_t)
daemontools_ipc_domain(qmail_smtpd_t)
')
dontaudit qmail_start_t self:capability sys_tty_config;
########################################
#
# tcp-env local policy
# this component sets up TCP-related environment variables
allow qmail_tcp_env_t qmail_smtpd_exec_t:file read;
sysnet_read_config(qmail_tcp_env_t)
corecmd_search_sbin(qmail_tcp_env_t)
optional_policy(`ucspitcp', `
ucspitcp_service_domain(qmail_tcp_env_t, qmail_tcp_env_exec_t)
')
# untested territory
optional_policy(`inetd', `
inetd_tcp_service_domain(qmail_tcp_env_t, qmail_tcp_env_exec_t)
')
[-- Attachment #2: Type: application/pgp-signature, Size: 200 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: qmail policy
2006-04-04 16:50 qmail policy Petre Rodan
@ 2006-04-05 15:38 ` Christopher J. PeBenito
0 siblings, 0 replies; 2+ messages in thread
From: Christopher J. PeBenito @ 2006-04-05 15:38 UTC (permalink / raw)
To: Petre Rodan; +Cc: SELinux List
On Tue, 2006-04-04 at 19:50 +0300, Petre Rodan wrote:
> attached you'll find the qmail policy and a small patch needed to
> integrate it into serefpol.
Merged, with some reordering. I renamed some interface names, and
removed qmail_var_run_t, which was unused.
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2006-04-05 15:38 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-04-04 16:50 qmail policy Petre Rodan
2006-04-05 15:38 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.