[refpolicy] [PATCH 12/15] postalias command should stay bin_t

[refpolicy] [PATCH 12/15] postalias command should stay bin_t

[Sven Vermeulen]

postalias should stay bin_t, is manually executed (no role executes 
postfix_master_exec_t as it is only to be launched through init scripts).

The postalias command is used to regenerate the aliases.db file from the
mail aliases and as such is a system administrative activity. However, by
default, no role has execute rights on any postfix_master_exec_t domains as
the domain is apparently meant only to be started from the run_init_t
domain.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 policy/modules/services/postfix.fc |    1 -
 1 files changed, 0 insertions(+), 1 deletions(-)

diff --git a/policy/modules/services/postfix.fc b/policy/modules/services/postfix.fc
index 958e241..4ceab5d 100644
--- a/policy/modules/services/postfix.fc
+++ b/policy/modules/services/postfix.fc
@@ -32,7 +32,6 @@ ifdef(`distro_redhat', `
 ')
 /etc/postfix/postfix-script.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
 /etc/postfix/prng_exch	--	gen_context(system_u:object_r:postfix_prng_t,s0)
-/usr/sbin/postalias	--	gen_context(system_u:object_r:postfix_master_exec_t,s0)
 /usr/sbin/postcat	--	gen_context(system_u:object_r:postfix_master_exec_t,s0)
 /usr/sbin/postdrop	--	gen_context(system_u:object_r:postfix_postdrop_exec_t,s0)
 /usr/sbin/postfix	--	gen_context(system_u:object_r:postfix_master_exec_t,s0)
-- 
1.7.3.4

[refpolicy] [PATCH 12/15] postalias command should stay bin_t

[Christopher J. PeBenito]

On 03/09/11 16:24, Sven Vermeulen wrote:
> postalias should stay bin_t, is manually executed (no role executes 
> postfix_master_exec_t as it is only to be launched through init scripts).
> 
> The postalias command is used to regenerate the aliases.db file from the
> mail aliases and as such is a system administrative activity. However, by
> default, no role has execute rights on any postfix_master_exec_t domains as
> the domain is apparently meant only to be started from the run_init_t
> domain.

Merged.

> Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
> ---
>  policy/modules/services/postfix.fc |    1 -
>  1 files changed, 0 insertions(+), 1 deletions(-)
> 
> diff --git a/policy/modules/services/postfix.fc b/policy/modules/services/postfix.fc
> index 958e241..4ceab5d 100644
> --- a/policy/modules/services/postfix.fc
> +++ b/policy/modules/services/postfix.fc
> @@ -32,7 +32,6 @@ ifdef(`distro_redhat', `
>  ')
>  /etc/postfix/postfix-script.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
>  /etc/postfix/prng_exch	--	gen_context(system_u:object_r:postfix_prng_t,s0)
> -/usr/sbin/postalias	--	gen_context(system_u:object_r:postfix_master_exec_t,s0)
>  /usr/sbin/postcat	--	gen_context(system_u:object_r:postfix_master_exec_t,s0)
>  /usr/sbin/postdrop	--	gen_context(system_u:object_r:postfix_postdrop_exec_t,s0)
>  /usr/sbin/postfix	--	gen_context(system_u:object_r:postfix_master_exec_t,s0)


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com