[refpolicy] [PATCH 1/1] The /var/qmail root is generic in nature (and definitely not qmail_etc_t)

[refpolicy] [PATCH 1/1] The /var/qmail root is generic in nature (and definitely not qmail_etc_t)

[Sven Vermeulen]

The original qmail module explicitly marked /var/qmail directory as
var_t as this location is nothing more than a generic root location. The
actual qmail specifics are subdirectories in this location.

Most domains that use qmail components do not expect this location to be
qmail_etc_t.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 policy/modules/kernel/files.fc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
index b876c48..c6c27c3 100644
--- a/policy/modules/kernel/files.fc
+++ b/policy/modules/kernel/files.fc
@@ -252,6 +252,8 @@ ifndef(`distro_redhat',`
 /var/lost\+found	-d	gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
 /var/lost\+found/.*		<<none>>
 
+/var/qmail		-d	gen_context(system_u:object_r:var_t,s0)
+
 /var/run		-d	gen_context(system_u:object_r:var_run_t,s0-mls_systemhigh)
 /var/run		-l	gen_context(system_u:object_r:var_run_t,s0)
 /var/run/.*			gen_context(system_u:object_r:var_run_t,s0)
-- 
1.8.5.5

[refpolicy] [PATCH 1/1] The /var/qmail root is generic in nature (and definitely not qmail_etc_t)

[Christopher J. PeBenito]

On 05/22/2014 01:55 PM, Sven Vermeulen wrote:
> The original qmail module explicitly marked /var/qmail directory as
> var_t as this location is nothing more than a generic root location. The
> actual qmail specifics are subdirectories in this location.
> 
> Most domains that use qmail components do not expect this location to be
> qmail_etc_t.
> 
> Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
> ---
>  policy/modules/kernel/files.fc | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
> index b876c48..c6c27c3 100644
> --- a/policy/modules/kernel/files.fc
> +++ b/policy/modules/kernel/files.fc
> @@ -252,6 +252,8 @@ ifndef(`distro_redhat',`
>  /var/lost\+found	-d	gen_context(system_u:object_r:lost_found_t,mls_systemhigh)
>  /var/lost\+found/.*		<<none>>
>  
> +/var/qmail		-d	gen_context(system_u:object_r:var_t,s0)
> +
>  /var/run		-d	gen_context(system_u:object_r:var_run_t,s0-mls_systemhigh)
>  /var/run		-l	gen_context(system_u:object_r:var_run_t,s0)
>  /var/run/.*			gen_context(system_u:object_r:var_run_t,s0)
 
It sounds like the file context in the qmail module needs to be fixed to not include /var/qmail instead.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

[refpolicy] [PATCH 1/1] The /var/qmail root is generic in nature (and definitely not qmail_etc_t)

[Sven Vermeulen]

The original qmail module explicitly marked /var/qmail directory as
var_t as this location is nothing more than a generic root location. The
actual qmail specifics are subdirectories in this location.

Most domains that use qmail components do not expect this location to be
qmail_etc_t.

Changes since v1
- Update qmail.fc instead of marking /var/qmail in kernel/files.fc

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 qmail.fc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qmail.fc b/qmail.fc
index e53fe5a..d5c6433 100644
--- a/qmail.fc
+++ b/qmail.fc
@@ -32,6 +32,6 @@
 /var/qmail/bin/splogger	--	gen_context(system_u:object_r:qmail_splogger_exec_t,s0)
 /var/qmail/bin/tcp-env	--	gen_context(system_u:object_r:qmail_tcp_env_exec_t,s0)
 
-/var/qmail(/.*)?	gen_context(system_u:object_r:qmail_etc_t,s0)
+/var/qmail/(.*)?	gen_context(system_u:object_r:qmail_etc_t,s0)
 
 /var/spool/qmail(/.*)?	gen_context(system_u:object_r:qmail_spool_t,s0)
-- 
1.8.5.5