Allow amavis_t to tcp connect to smtp_beforequeue_port_t.
PATCH 2/5 Allow amavis_t to tcp connect to smtp_beforequeue_port_t.
Allow amavis_t to tcp connect to smtp_beforequeue_port_t and allow amavis_t to send and receive smtp_beforequeue client packets.
Remove redundant policy that allows amavis to tcp send and receive to and from amavis send and recv ports. Amavis already is allowed to tcp send and receive to and from all ports.
Remove policy that allows amavis_t to tcp connect to amavisd_send_port_t since it was replaced by smtp_beforequeue_port_t.
Signed-off-by Dominick Grift <[email protected]>
---
:100644 100644 ee09816... 0d0e3da... M policy/modules/services/amavis.te
policy/modules/services/amavis.te | 7 ++----- 1 files changed, 2 insertions(+), 5 deletions(-)
policy/modules/services/amavis.te +2 -5
@@ -108,17 +108,14 @@ corecmd_exec_bin(amavis_t) corenet_all_recvfrom_unlabeled(amavis_t) corenet_all_recvfrom_netlabel(amavis_t) +corenet_sendrecv_smtp_beforequeue_client_packets(amavis_t) corenet_tcp_sendrecv_generic_if(amavis_t) corenet_tcp_sendrecv_generic_node(amavis_t) corenet_tcp_bind_generic_node(amavis_t) corenet_udp_bind_generic_node(amavis_t) -# amavis uses well-defined ports -corenet_tcp_sendrecv_amavisd_recv_port(amavis_t) -corenet_tcp_sendrecv_amavisd_send_port(amavis_t) -# just the other side not. ;-) corenet_tcp_sendrecv_all_ports(amavis_t) # connect to backchannel port -corenet_tcp_connect_amavisd_send_port(amavis_t) +corenet_tcp_connect_smtp_beforequeue_port(amavis_t) # bind to incoming port corenet_tcp_bind_amavisd_recv_port(amavis_t) corenet_udp_bind_generic_port(amavis_t)
Signature · 9 lines
1.7.0.1 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100427/c26adb9e/attachment.bin