The /var/qmail root is generic in nature (and definitely not qmail_etc_t)
PATCH v3 1/1 The /var/qmail root is generic in nature (and definitely not qmail_etc_t)
The original qmail module explicitly marked /var/qmail directory as var_t as this location is nothing more than a generic root location. The actual qmail specifics are subdirectories in this location.
Most domains that use qmail components do not expect this location to be qmail_etc_t.
Changes since v2
- Use .+ instead of (.*)? expression as suggested on #selinux
--- qmail.fc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
qmail.fc +1 -1
@@ -32,6 +32,6 @@ /var/qmail/bin/splogger -- gen_context(system_u:object_r:qmail_splogger_exec_t,s0) /var/qmail/bin/tcp-env -- gen_context(system_u:object_r:qmail_tcp_env_exec_t,s0) -/var/qmail(/.*)? gen_context(system_u:object_r:qmail_etc_t,s0) +/var/qmail/.+ gen_context(system_u:object_r:qmail_etc_t,s0) /var/spool/qmail(/.*)? gen_context(system_u:object_r:qmail_spool_t,s0)
Signature · 1 line
1.8.5.5
PATCH v3 1/1 The /var/qmail root is generic in nature (and definitely not qmail_etc_t)
The problem with this change, is it would break a confined admin. If a confined admin tried to create new content in /var/qmail he would be denied.
Quoted 27 lines · Sven Vermeulen
The original qmail module explicitly marked
/var/qmaildirectory asvar_tas this location is nothing more than a generic root location. The actual qmail specifics are subdirectories in this location.Most domains that use qmail components do not expect this location to be
qmail_etc_t.Changes since v2
- Use .+ instead of (.*)? expression as suggested on #selinuxSigned-off-by Sven Vermeulen <[email protected]>--- qmail.fc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)qmail.fc +1
-1@@ -32,6 +32,6 @@ /var/qmail/bin/splogger -- gen_context(system_u:object_r:qmail_splogger_exec_t,s0) /var/qmail/bin/tcp-env -- gen_context(system_u:object_r:qmail_tcp_env_exec_t,s0) -/var/qmail(/.*)? gen_context(system_u:object_r:qmail_etc_t,s0) +/var/qmail/.+ gen_context(system_u:object_r:qmail_etc_t,s0) /var/spool/qmail(/.*)? gen_context(system_u:object_r:qmail_spool_t,s0)
PATCH v3 1/1 The /var/qmail root is generic in nature (and definitely not qmail_etc_t)
Quoted 5 lines · Daniel J Walsh
The problem with this change, is it would break a confined admin. If a confined admin tried to create new content in
/var/qmailhe would be denied.qmail.fc line 35
Quoted 2 lines
qmail.fc +1
-1-/var/qmail(/.*)? gen_context(system_u:object_r:qmail_etc_t,s0) +/var/qmail/.+ gen_context(system_u:object_r:qmail_etc_t,s0)
In that case it would make more sense to follow the best practice that is used by most daemons, that is to label /var/qmail as a qmail-specific variable type (like qmail_var_t) and have specific files under it as the configuration type (qmail_etc_t) as needed.
It sucks a bit that qmail has this change structure. It is the original (?) qmail.fc author that contacted me about this, as the (then NSA-provided) qmail.fc didn't mark /var/qmail as qmail_etc_t.
Wkr,
Sven Vermeulen
PATCH v3 1/1 The /var/qmail root is generic in nature (and definitely not qmail_etc_t)
In reply to Daniel J WalshHi,
I wrote that policy a few years back.
Quoted 3 lines · Daniel J Walsh
The problem with this change, is it would break a confined admin. If a confined admin tried to create new content in
/var/qmailhe would be denied. On 05/28/2014 01:11 PM, Sven Vermeulen wrote:
what new content are you refering to?
as far as a standard qmail install goes, the only thing that is customizable once qmail is installed are files inside /var/qmail/alias/ (qmail_alias_home_t) and the configurations inside /var/qmail/control/ (qmail_etc_t).
if /var/qmail ends up being anything else than var_t then all software that uses /var/qmail/bin/sendmail needs to have rights to reach that binary. probably via mta_sendmail_* if tweaks.
on a different note also /var/qmail/queue(/.*)? is currently mislabeled and should be system_u:object_r:qmail_spool_t.
cheers,
peter
Quoted 32 lines
Quoted 20 lines
The original qmail module explicitly marked
/var/qmaildirectory asvar_tas this location is nothing more than a generic root location. The actual qmail specifics are subdirectories in this location.Most domains that use qmail components do not expect this location to be
qmail_etc_t.Changes since v2
- Use .+ instead of (.*)? expression as suggested on #selinuxSigned-off-by Sven Vermeulen <[email protected]>--- qmail.fc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)qmail.fc +0
-0qmail.fc line 37
Quoted 7 lines
qmail.fc +1
-1@@ -32,6 +32,6 @@ /var/qmail/bin/splogger -- gen_context(system_u:object_r:qmail_splogger_exec_t,s0) /var/qmail/bin/tcp-env -- gen_context(system_u:object_r:qmail_tcp_env_exec_t,s0) -/var/qmail(/.*)? gen_context(system_u:object_r:qmail_etc_t,s0) +/var/qmail/.+ gen_context(system_u:object_r:qmail_etc_t,s0) /var/spool/qmail(/.*)? gen_context(system_u:object_r:qmail_spool_t,s0)_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Signature · 11 lines
petre rodan <[email protected]> Technical Manager Simplex SRL, Bucharest -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140529/17a3069c/attachment.bin
PATCH v3 1/1 The /var/qmail root is generic in nature (and definitely not qmail_etc_t)
In reply to Sven VermeulenQuoted 6 lines · Sven Vermeulen
The original qmail module explicitly marked
/var/qmaildirectory asvar_tas this location is nothing more than a generic root location. The actual qmail specifics are subdirectories in this location.Most domains that use qmail components do not expect this location to be
qmail_etc_t.
I'm holding off on making any decisions regarding this change, pending resolution to Dan and Petre's questions/concerns.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com