[refpolicy] [ Implement ClamSMTPd policy. 1/5] Implement advanced content filtering.

[domg472@gmail.com (Dominick Grift)]

Content filtering software can receive and deliver mail via SMTP.

Content filtering programs receive SMTP mail via localhost port 10025,
and submit SMTP mail back into Postfix via localhost port 10026.

These ports are refered to as before queue content filter and
after queue content filter ports respectively.

Declare tcp, 10025, s0 smtp_beforequeue_port_t.
Declare tcp, 10026, s0 smtp_afterqueue_port_t.

Remove the amavisd_send_port_t declaration. Amavisd_t will be
allowed to tcp connect to smtp_beforequeue_port_t, and will
be allowed to send and receive smtp before queue content filter
client packets instead.

Signed-off-by: Dominick Grift <domg472@gmail.com>
---
:100644 100644 6381618... 30daeea... M	policy/modules/kernel/corenetwork.te.in
 policy/modules/kernel/corenetwork.te.in |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
index 6381618..30daeea 100644
--- a/policy/modules/kernel/corenetwork.te.in
+++ b/policy/modules/kernel/corenetwork.te.in
@@ -72,7 +72,6 @@ network_port(afs_vl, udp,7003,s0)
 network_port(agentx, udp,705,s0, tcp,705,s0)
 network_port(amanda, udp,10080-10082,s0, tcp,10080-10083,s0)
 network_port(amavisd_recv, tcp,10024,s0)
-network_port(amavisd_send, tcp,10025,s0)
 network_port(aol, udp,5190-5193,s0, tcp,5190-5193,s0) 
 network_port(apcupsd, tcp,3551,s0, udp,3551,s0)
 network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0)
@@ -182,6 +181,8 @@ network_port(sap, tcp,9875,s0, udp,9875,s0)
 network_port(sip, tcp,5060,s0, udp,5060,s0, tcp,5061,s0, udp,5061,s0)
 network_port(smbd, tcp,137-139,s0, tcp,445,s0)
 network_port(smtp, tcp,25,s0, tcp,465,s0, tcp,587,s0)
+network_port(smtp_afterqueue, tcp,10026,s0)
+network_port(smtp_beforequeue, tcp,10025,s0)
 network_port(snmp, udp,161,s0, udp,162,s0, tcp,199,s0, tcp, 1161, s0)
 type socks_port_t, port_type; dnl network_port(socks) # no defined portcon
 network_port(soundd, tcp,8000,s0, tcp,9433,s0, tcp, 16001, s0)
-- 
1.7.0.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100427/d15820e0/attachment.bin