[refpolicy] [ Implement ClamSMTPd policy. 1/5] Implement advanced content filtering.

[refpolicy] [ Implement ClamSMTPd policy. 1/5] Implement advanced content filtering.

[Dominick Grift]

Content filtering software can receive and deliver mail via SMTP.

Content filtering programs receive SMTP mail via localhost port 10025,
and submit SMTP mail back into Postfix via localhost port 10026.

These ports are refered to as before queue content filter and
after queue content filter ports respectively.

Declare tcp, 10025, s0 smtp_beforequeue_port_t.
Declare tcp, 10026, s0 smtp_afterqueue_port_t.

Remove the amavisd_send_port_t declaration. Amavisd_t will be
allowed to tcp connect to smtp_beforequeue_port_t, and will
be allowed to send and receive smtp before queue content filter
client packets instead.

Signed-off-by: Dominick Grift <domg472@gmail.com>
---
:100644 100644 6381618... 30daeea... M	policy/modules/kernel/corenetwork.te.in
 policy/modules/kernel/corenetwork.te.in |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
index 6381618..30daeea 100644
--- a/policy/modules/kernel/corenetwork.te.in
+++ b/policy/modules/kernel/corenetwork.te.in
@@ -72,7 +72,6 @@ network_port(afs_vl, udp,7003,s0)
 network_port(agentx, udp,705,s0, tcp,705,s0)
 network_port(amanda, udp,10080-10082,s0, tcp,10080-10083,s0)
 network_port(amavisd_recv, tcp,10024,s0)
-network_port(amavisd_send, tcp,10025,s0)
 network_port(aol, udp,5190-5193,s0, tcp,5190-5193,s0) 
 network_port(apcupsd, tcp,3551,s0, udp,3551,s0)
 network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0)
@@ -182,6 +181,8 @@ network_port(sap, tcp,9875,s0, udp,9875,s0)
 network_port(sip, tcp,5060,s0, udp,5060,s0, tcp,5061,s0, udp,5061,s0)
 network_port(smbd, tcp,137-139,s0, tcp,445,s0)
 network_port(smtp, tcp,25,s0, tcp,465,s0, tcp,587,s0)
+network_port(smtp_afterqueue, tcp,10026,s0)
+network_port(smtp_beforequeue, tcp,10025,s0)
 network_port(snmp, udp,161,s0, udp,162,s0, tcp,199,s0, tcp, 1161, s0)
 type socks_port_t, port_type; dnl network_port(socks) # no defined portcon
 network_port(soundd, tcp,8000,s0, tcp,9433,s0, tcp, 16001, s0)
-- 
1.7.0.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100427/d15820e0/attachment.bin 

[refpolicy] [ Implement ClamSMTPd policy. 1/5] Implement advanced content filtering.

[Christopher J. PeBenito]

On Tue, 2010-04-27 at 13:52 +0200, Dominick Grift wrote:
> Content filtering software can receive and deliver mail via SMTP.
> 
> Content filtering programs receive SMTP mail via localhost port 10025,
> and submit SMTP mail back into Postfix via localhost port 10026.
> 
> These ports are refered to as before queue content filter and
> after queue content filter ports respectively.
> 
> Declare tcp, 10025, s0 smtp_beforequeue_port_t.
> Declare tcp, 10026, s0 smtp_afterqueue_port_t.
> 
> Remove the amavisd_send_port_t declaration. Amavisd_t will be
> allowed to tcp connect to smtp_beforequeue_port_t, and will
> be allowed to send and receive smtp before queue content filter
> client packets instead.

I think we should keep the amavis port labeling as is; it has been
around a long time.  The type name for 10026 should also be less
ambiguous; clamsmtp is probably fine.

> Signed-off-by: Dominick Grift <domg472@gmail.com>
> ---
> :100644 100644 6381618... 30daeea... M	policy/modules/kernel/corenetwork.te.in
>  policy/modules/kernel/corenetwork.te.in |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
> 
> diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
> index 6381618..30daeea 100644
> --- a/policy/modules/kernel/corenetwork.te.in
> +++ b/policy/modules/kernel/corenetwork.te.in
> @@ -72,7 +72,6 @@ network_port(afs_vl, udp,7003,s0)
>  network_port(agentx, udp,705,s0, tcp,705,s0)
>  network_port(amanda, udp,10080-10082,s0, tcp,10080-10083,s0)
>  network_port(amavisd_recv, tcp,10024,s0)
> -network_port(amavisd_send, tcp,10025,s0)
>  network_port(aol, udp,5190-5193,s0, tcp,5190-5193,s0) 
>  network_port(apcupsd, tcp,3551,s0, udp,3551,s0)
>  network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0)
> @@ -182,6 +181,8 @@ network_port(sap, tcp,9875,s0, udp,9875,s0)
>  network_port(sip, tcp,5060,s0, udp,5060,s0, tcp,5061,s0, udp,5061,s0)
>  network_port(smbd, tcp,137-139,s0, tcp,445,s0)
>  network_port(smtp, tcp,25,s0, tcp,465,s0, tcp,587,s0)
> +network_port(smtp_afterqueue, tcp,10026,s0)
> +network_port(smtp_beforequeue, tcp,10025,s0)
>  network_port(snmp, udp,161,s0, udp,162,s0, tcp,199,s0, tcp, 1161, s0)
>  type socks_port_t, port_type; dnl network_port(socks) # no defined portcon
>  network_port(soundd, tcp,8000,s0, tcp,9433,s0, tcp, 16001, s0)
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com