Implement advanced content filtering.
PATCH 1/5 Implement advanced content filtering.
Content filtering software can receive and deliver mail via SMTP.
Content filtering programs receive SMTP mail via localhost port 10025, and submit SMTP mail back into Postfix via localhost port 10026.
These ports are refered to as before queue content filter and after queue content filter ports respectively.
Declare tcp, 10025, s0 smtp_beforequeue_port_t.
Declare tcp, 10026, s0 smtp_afterqueue_port_t.
Remove the amavisd_send_port_t declaration. Amavisd_t will be allowed to tcp connect to smtp_beforequeue_port_t, and will be allowed to send and receive smtp before queue content filter client packets instead.
---
:100644 100644 6381618... 30daeea... M policy/modules/kernel/corenetwork.te.in
policy/modules/kernel/corenetwork.te.in | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-)
policy/modules/kernel/corenetwork.te.in +2 -1
@@ -72,7 +72,6 @@ network_port(afs_vl, udp,7003,s0) network_port(agentx, udp,705,s0, tcp,705,s0) network_port(amanda, udp,10080-10082,s0, tcp,10080-10083,s0) network_port(amavisd_recv, tcp,10024,s0) -network_port(amavisd_send, tcp,10025,s0) network_port(aol, udp,5190-5193,s0, tcp,5190-5193,s0) network_port(apcupsd, tcp,3551,s0, udp,3551,s0) network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0)
@@ -182,6 +181,8 @@ network_port(sap, tcp,9875,s0, udp,9875,s0) network_port(sip, tcp,5060,s0, udp,5060,s0, tcp,5061,s0, udp,5061,s0) network_port(smbd, tcp,137-139,s0, tcp,445,s0) network_port(smtp, tcp,25,s0, tcp,465,s0, tcp,587,s0) +network_port(smtp_afterqueue, tcp,10026,s0) +network_port(smtp_beforequeue, tcp,10025,s0) network_port(snmp, udp,161,s0, udp,162,s0, tcp,199,s0, tcp, 1161, s0) type socks_port_t, port_type; dnl network_port(socks) # no defined portcon network_port(soundd, tcp,8000,s0, tcp,9433,s0, tcp, 16001, s0)
Signature · 9 lines
1.7.0.1 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100427/d15820e0/attachment.bin
PATCH 1/5 Implement advanced content filtering.
Quoted 8 lines · Dominick Grift
Content filtering software can receive and deliver mail via SMTP.
Content filtering programs receive SMTP mail via localhost port 10025, and submit SMTP mail back into Postfix via localhost port 10026.
These ports are refered to as before queue content filter and after queue content filter ports respectively.
Quoted 7 lines
Declare tcp, 10025, s0
smtp_beforequeue_port_t.
Declare tcp, 10026, s0smtp_afterqueue_port_t.Remove the
amavisd_send_port_tdeclaration.Amavisd_twill be allowed to tcp connect tosmtp_beforequeue_port_t, and will be allowed to send and receive smtp before queue content filter client packets instead.
I think we should keep the amavis port labeling as is; it has been around a long time. The type name for 10026 should also be less ambiguous; clamsmtp is probably fine.
Quoted 31 lines
Signed-off-by Dominick Grift <[email protected]>---
:100644 100644 6381618... 30daeea... M policy/modules/kernel/corenetwork.te.inpolicy/modules/kernel/corenetwork.te.in | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-)policy/modules/kernel/corenetwork.te.in +2
-1@@ -72,7 +72,6 @@ network_port(afs_vl, udp,7003,s0) network_port(agentx, udp,705,s0, tcp,705,s0) network_port(amanda, udp,10080-10082,s0, tcp,10080-10083,s0) network_port(amavisd_recv, tcp,10024,s0) -network_port(amavisd_send, tcp,10025,s0) network_port(aol, udp,5190-5193,s0, tcp,5190-5193,s0) network_port(apcupsd, tcp,3551,s0, udp,3551,s0) network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0)@@ -182,6 +181,8 @@ network_port(sap, tcp,9875,s0, udp,9875,s0) network_port(sip, tcp,5060,s0, udp,5060,s0, tcp,5061,s0, udp,5061,s0) network_port(smbd, tcp,137-139,s0, tcp,445,s0) network_port(smtp, tcp,25,s0, tcp,465,s0, tcp,587,s0) +network_port(smtp_afterqueue, tcp,10026,s0) +network_port(smtp_beforequeue, tcp,10025,s0) network_port(snmp, udp,161,s0, udp,162,s0, tcp,199,s0, tcp, 1161, s0) type socks_port_t, port_type; dnl network_port(socks) # no defined portcon network_port(soundd, tcp,8000,s0, tcp,9433,s0, tcp, 16001, s0)_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com