Re: pyzor/spam changes in policy

[Daniel J Walsh <dwalsh@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1871 bytes --]

Christopher J. PeBenito wrote:
> On Mon, 2007-02-26 at 12:35 -0500, dwalsh@localhost.localdomain wrote:
>   
>> New directory for spamassin /var/lib/
>> spam needs to send signals to pyzor
>> pyzor uses tmp files
>>     
>
> Merged most,  exceptions:
>
>   
>> +interface(`spamassassin_manage_lib_files',`
>> +	gen_require(`
>> +		type spamd_var_lib_t;
>> +	')
>> +
>> +	files_search_var_lib($1)
>> +	manage_dirs_pattern($1,spamd_var_lib_t,spamd_var_lib_t)
>> +	manage_files_pattern($1,spamd_var_lib_t,spamd_var_lib_t)
>> +')
>>     
>
> Removed the dirs part.  If there is an interface needed that has both,
> then there should be a more abstract interface.
>
>   
>> @@ -139,6 +148,7 @@
>>  
>>  	tunable_policy(`spamd_enable_home_dirs',`
>>  		userdom_home_filetrans_generic_user_home_dir(spamd_t)
>> +		userdom_manage_generic_user_home_dirs(spamd_t)
>>  		userdom_manage_generic_user_home_content_dirs(spamd_t)
>>  		userdom_manage_generic_user_home_content_files(spamd_t)
>>  		userdom_manage_generic_user_home_content_symlinks(spamd_t)
>>     
>
> I don't understand why spamd_t would be creating new top level home
> diretories, for example the /home/myuser dir.
>
>   
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=203290
>> @@ -184,6 +194,7 @@
>>  
>>  optional_policy(`
>>  	pyzor_domtrans(spamd_t)
>> +	pyzor_signal(spamd_t)
>>  ')
>>     
>
> Dropped this and the following, because the interface looks wrong ($1 is
> the object).
>
>   
>> +########################################
>> +## <summary>
>> +##	Send generic signals to pyzor
>> +## </summary>
>> +## <param name="domain">
>> +##	<summary>
>> +##	Domain allowed access.
>> +##	</summary>
>> +## </param>
>> +#
>> +interface(`pyzor_signal',`
>> +	gen_require(`
>> +		type pyzor_t;
>> +	')
>> +
>> +	allow pyzor_t $1:process signal;
>> +')
>>     
>
>   

This should be reversed,  New patch


[-- Attachment #2: spam.diff --]
[-- Type: text/x-patch, Size: 1410 bytes --]

--- nsaserefpolicy/policy/modules/services/spamassassin.te	2007-03-08 08:26:59.000000000 -0500
+++ serefpolicy-2.5.8/policy/modules/services/spamassassin.te	2007-03-08 09:00:04.000000000 -0500
@@ -85,6 +85,7 @@
 corenet_tcp_bind_all_nodes(spamd_t)
 corenet_tcp_bind_spamd_port(spamd_t)
 corenet_tcp_connect_razor_port(spamd_t)
+corenet_tcp_connect_smtp_port(spamd_t)
 corenet_sendrecv_razor_client_packets(spamd_t)
 corenet_sendrecv_spamd_server_packets(spamd_t)
 # spamassassin 3.1 needs this for its
@@ -147,6 +148,7 @@
 
 	tunable_policy(`spamd_enable_home_dirs',`
 		userdom_home_filetrans_generic_user_home_dir(spamd_t)
+		userdom_manage_generic_user_home_dirs(spamd_t)
 		userdom_manage_generic_user_home_content_dirs(spamd_t)
 		userdom_manage_generic_user_home_content_files(spamd_t)
 		userdom_manage_generic_user_home_content_symlinks(spamd_t)
--- nsaserefpolicy/policy/modules/services/pyzor.te	2007-03-08 08:26:59.000000000 -0500
+++ serefpolicy-2.5.8/policy/modules/services/pyzor.te	2007-03-08 08:59:23.000000000 -0500
@@ -44,6 +44,8 @@
 manage_dirs_pattern(pyzor_t,pyzor_tmp_t,pyzor_tmp_t)
 files_tmp_filetrans(pyzor_t, pyzor_tmp_t, { file dir })
 
+fs_search_auto_mountpoints(pyzor_t)
+
 kernel_read_kernel_sysctls(pyzor_t)  
 kernel_read_system_state(pyzor_t)
 
@@ -77,6 +79,7 @@
 ')
 
 optional_policy(`
+	spamassassin_signal_spamd(pyzor_t)
 	spamassassin_read_spamd_tmp_files(pyzor_t)
 ')