postalias command should stay bin_t
PATCH 12/15 postalias command should stay bin_t
postalias should stay bin_t, is manually executed (no role executes postfix_master_exec_t as it is only to be launched through init scripts).
The postalias command is used to regenerate the aliases.db file from the mail aliases and as such is a system administrative activity. However, by default, no role has execute rights on any postfix_master_exec_t domains as the domain is apparently meant only to be started from the run_init_t domain.
--- policy/modules/services/postfix.fc | 1 - 1 files changed, 0 insertions(+), 1 deletions(-)
policy/modules/services/postfix.fc +0 -1
@@ -32,7 +32,6 @@ ifdef(`distro_redhat', ` ') /etc/postfix/postfix-script.* -- gen_context(system_u:object_r:postfix_exec_t,s0) /etc/postfix/prng_exch -- gen_context(system_u:object_r:postfix_prng_t,s0) -/usr/sbin/postalias -- gen_context(system_u:object_r:postfix_master_exec_t,s0) /usr/sbin/postcat -- gen_context(system_u:object_r:postfix_master_exec_t,s0) /usr/sbin/postdrop -- gen_context(system_u:object_r:postfix_postdrop_exec_t,s0) /usr/sbin/postfix -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
Signature · 1 line
1.7.3.4
PATCH 12/15 postalias command should stay bin_t
Quoted 8 lines · Sven Vermeulen
postalias should stay
bin_t, is manually executed (no role executespostfix_master_exec_tas it is only to be launched through init scripts).The postalias command is used to regenerate the aliases.db file from the mail aliases and as such is a system administrative activity. However, by default, no role has execute rights on any
postfix_master_exec_tdomains as the domain is apparently meant only to be started from therun_init_tdomain.
Merged.
Quoted 17 lines
Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/services/postfix.fc | 1 - 1 files changed, 0 insertions(+), 1 deletions(-)policy/modules/services/postfix.fc +0
-1@@ -32,7 +32,6 @@ ifdef(`distro_redhat', ` ') /etc/postfix/postfix-script.* -- gen_context(system_u:object_r:postfix_exec_t,s0) /etc/postfix/prng_exch -- gen_context(system_u:object_r:postfix_prng_t,s0) -/usr/sbin/postalias -- gen_context(system_u:object_r:postfix_master_exec_t,s0) /usr/sbin/postcat -- gen_context(system_u:object_r:postfix_master_exec_t,s0) /usr/sbin/postdrop -- gen_context(system_u:object_r:postfix_postdrop_exec_t,s0) /usr/sbin/postfix -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com