This is what i think would probably have to be modifies to make mail home work.
PATCH 1/1 This is what i think would probably have to be modifies to make mail home work.
It builds but it is untested. I think that qmail may also need this access but i could not find any evidence of this.
Signed-off-by Dominick Grift <[email protected]>
---
:100644 100644 3fd227b... 5b7268e... M policy/modules/roles/staff.te
:100644 100644 2ed3c67... c918465... M policy/modules/roles/sysadm.te
:100644 100644 b0be6d2... 62a1760... M policy/modules/roles/unprivuser.te
:100644 100644 5c3d708... 193c77e... M policy/modules/services/courier.te
:100644 100644 9f16e2e... 96e362c... M policy/modules/services/dovecot.te
:100644 100644 fccf3f8... 1d6660a... M policy/modules/services/exim.te
:100644 100644 256166a... f39f7f4... M policy/modules/services/mta.fc
:100644 100644 44e782e... 910f1aa... M policy/modules/services/mta.if
:100644 100644 797d86b... bab7d6f... M policy/modules/services/mta.te
:100644 100644 1343621... 69d6180... M policy/modules/services/procmail.fc
:100644 100644 f68e025... 20580d3... M policy/modules/services/procmail.if
:100644 100644 a51bbf6... ff1470a... M policy/modules/services/procmail.te
policy/modules/roles/staff.te | 7 ++ policy/modules/roles/sysadm.te | 7 ++ policy/modules/roles/unprivuser.te | 7 ++ policy/modules/services/courier.te | 4 +- policy/modules/services/dovecot.te | 18 +--- policy/modules/services/exim.te | 4 + policy/modules/services/mta.fc | 9 ++- policy/modules/services/mta.if | 170 +++++++++++++++++++++++++++++++++++ policy/modules/services/mta.te | 16 ++-- policy/modules/services/procmail.fc | 12 ++- policy/modules/services/procmail.if | 61 +++++++++++++ policy/modules/services/procmail.te | 13 ++-- 12 files changed, 293 insertions(+), 35 deletions(-)
policy/modules/roles/staff.te +7 -0
@@ -93,6 +93,8 @@ optional_policy(` optional_policy(` mta_role(staff_r, staff_t) + mta_manage_mail_home(staff_t) + mta_relabel_mail_home(staff_t) ') optional_policy(`
@@ -105,6 +107,11 @@ optional_policy(` ') optional_policy(` + procmail_manage_user_content_files(staff_t) + procmail_relabel_user_content_files(staff_t) +') + +optional_policy(` pyzor_role(staff_r, staff_t) ')
policy/modules/roles/sysadm.te +7 -0
@@ -264,6 +264,8 @@ optional_policy(` optional_policy(` mta_role(sysadm_r, sysadm_t) + mta_manage_mail_home(sysadm_t) + mta_relabel_mail_home(sysadm_t) ') optional_policy(`
@@ -308,6 +310,11 @@ optional_policy(` ') optional_policy(` + procmail_manage_user_content_files(sysadm_t) + procmail_relabel_user_content_files(sysadm_t) +') + +optional_policy(` pyzor_role(sysadm_r, sysadm_t) ')
policy/modules/roles/unprivuser.te +7 -0
@@ -87,6 +87,8 @@ optional_policy(` optional_policy(` mta_role(user_r, user_t) + mta_manage_mail_home(user_t) + mta_relabel_mail_home(user_t) ') optional_policy(`
@@ -99,6 +101,11 @@ optional_policy(` ') optional_policy(` + procmail_manage_user_content_files(user_t) + procmail_relabel_user_content_files(user_t) +') + +optional_policy(` pyzor_role(user_r, user_t) ')
policy/modules/services/courier.te +2 -2
@@ -101,12 +101,12 @@ miscfiles_read_localization(courier_pop_t) courier_domtrans_authdaemon(courier_pop_t) # do the actual work (read the Maildir) -userdom_manage_user_home_content_files(courier_pop_t) +mta_manage_mail_home(courier_pop_t) +mta_user_home_filetrans_mail_home(courier_pop_t) # cjp: the fact that this is different for pop vs imap means that # there should probably be a courier_pop_t and courier_imap_t # this should also probably be a separate type too instead of # the regular home dir -userdom_manage_user_home_content_dirs(courier_pop_t) ######################################## #
policy/modules/services/dovecot.te +5 -13
@@ -128,15 +128,12 @@ miscfiles_read_certs(dovecot_t) miscfiles_read_localization(dovecot_t) userdom_dontaudit_use_unpriv_user_fds(dovecot_t) -userdom_manage_user_home_content_dirs(dovecot_t) -userdom_manage_user_home_content_files(dovecot_t) -userdom_manage_user_home_content_symlinks(dovecot_t) -userdom_manage_user_home_content_pipes(dovecot_t) -userdom_manage_user_home_content_sockets(dovecot_t) -userdom_user_home_dir_filetrans_user_home_content(dovecot_t, { dir file lnk_file fifo_file sock_file }) mta_manage_spool(dovecot_t) +mta_manage_mail_home(dovecot_t) +mta_user_home_filetrans_mail_home(dovecot_t) + optional_policy(` kerberos_keytab_template(dovecot, dovecot_t) ')
@@ -255,13 +252,6 @@ files_search_tmp(dovecot_deliver_t) fs_getattr_all_fs(dovecot_deliver_t) -userdom_manage_user_home_content_dirs(dovecot_deliver_t) -userdom_manage_user_home_content_files(dovecot_deliver_t) -userdom_manage_user_home_content_symlinks(dovecot_deliver_t) -userdom_manage_user_home_content_pipes(dovecot_deliver_t) -userdom_manage_user_home_content_sockets(dovecot_deliver_t) -userdom_user_home_dir_filetrans_user_home_content(dovecot_deliver_t, { dir file lnk_file fifo_file sock_file }) - tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_files(dovecot_t) fs_manage_nfs_symlinks(dovecot_t)
@@ -274,4 +264,6 @@ tunable_policy(`use_samba_home_dirs',` optional_policy(` mta_manage_spool(dovecot_deliver_t) + mta_manage_mail_home(dovecot_deliver_t) + mta_user_home_filetrans_mail_home(dovecot_deliver_t) ')
policy/modules/services/exim.te +4 -0
@@ -130,6 +130,10 @@ mta_read_config(exim_t) mta_manage_spool(exim_t) mta_mailserver_delivery(exim_t) +# Not sure about this but makes sense. +mta_manage_mail_home(exim_t) +mta_user_home_filetrans_mail_home(exim_t) + tunable_policy(`exim_can_connect_db',` corenet_tcp_connect_mysqld_port(exim_t) corenet_sendrecv_mysqld_client_packets(exim_t)
policy/modules/services/mta.fc +6 -3
@@ -1,4 +1,5 @@ HOME_DIR/\.forward -- gen_context(system_u:object_r:mail_forward_t,s0) +HOME_DIR/Mail(/.*)? gen_context(system_u:object_r:mail_home_t,s0) /bin/mail(x)? -- gen_context(system_u:object_r:sendmail_exec_t,s0)
@@ -7,9 +8,6 @@ HOME_DIR/\.forward -- gen_context(system_u:object_r:mail_forward_t,s0) /etc/mail(/.*)? gen_context(system_u:object_r:etc_mail_t,s0) /etc/mail/aliases -- gen_context(system_u:object_r:etc_aliases_t,s0) /etc/mail/aliases\.db -- gen_context(system_u:object_r:etc_aliases_t,s0) -ifdef(`distro_redhat',` -/etc/postfix/aliases.* gen_context(system_u:object_r:etc_aliases_t,s0) -') /usr/bin/esmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0)
@@ -28,3 +26,8 @@ ifdef(`distro_redhat',` /var/spool/imap(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) /var/spool/(client)?mqueue(/.*)? gen_context(system_u:object_r:mqueue_spool_t,s0) /var/spool/mail(/.*)? gen_context(system_u:object_r:mail_spool_t,s0) + +ifdef(`distro_redhat',` +/etc/postfix/aliases.* gen_context(system_u:object_r:etc_aliases_t,s0) +/root/\.forward -- gen_context(system_u:object_r:mail_forward_t,s0) +')
policy/modules/services/mta.if +170 -0
185 lines not on this page · raw message
policy/modules/services/mta.te +8 -8
@@ -44,6 +44,10 @@ typealias user_mail_tmp_t alias { auditadm_mail_tmp_t secadm_mail_tmp_t }; ubac_constrained(user_mail_t) ubac_constrained(user_mail_tmp_t) +# postfix, sendmail, exim, qmail, procmail, courier +type mail_home_t; +userdom_user_home_content(mail_home_t) + ######################################## # # System mail local policy
@@ -256,16 +260,12 @@ userdom_use_user_terminals(user_mail_t) # Write to the user domain tty. cjp: why? userdom_use_user_terminals(mta_user_agent) # Create dead.letter in user home directories. -userdom_manage_user_home_content_files(user_mail_t) -userdom_user_home_dir_filetrans_user_home_content(user_mail_t, file) +mta_manage_mail_home_files(user_mail_t) +mta_user_home_filetrans_mail_home_files(user_mail_t) # for reading .forward - maybe we need a new type for it? # also for delivering mail to maildir -userdom_manage_user_home_content_dirs(mailserver_delivery) -userdom_manage_user_home_content_files(mailserver_delivery) -userdom_manage_user_home_content_symlinks(mailserver_delivery) -userdom_manage_user_home_content_pipes(mailserver_delivery) -userdom_manage_user_home_content_sockets(mailserver_delivery) -userdom_user_home_dir_filetrans_user_home_content(mailserver_delivery, { dir file lnk_file fifo_file sock_file }) +mta_manage_mail_home(mailserver_delivery) +mta_user_home_filetrans_mail_home(mailserver_delivery) # Read user temporary files. userdom_read_user_tmp_files(user_mail_t) userdom_dontaudit_append_user_tmp_files(user_mail_t)
policy/modules/services/procmail.fc +9 -3
@@ -1,5 +1,11 @@ +HOME_DIR/\.procmailrc -- gen_context(system_u:object_r:procmail_home_t,s0) -/usr/bin/procmail -- gen_context(system_u:object_r:procmail_exec_t,s0) +/usr/bin/procmail -- gen_context(system_u:object_r:procmail_exec_t,s0) + +/var/log/procmail\.log.* -- gen_context(system_u:object_r:procmail_log_t,s0) +/var/log/procmail(/.*)? gen_context(system_u:object_r:procmail_log_t,s0) + +ifdef(`distro_redhat',` +/root/\.procmailrc -- gen_context(system_u:object_r:procmail_home_t,s0) +') -/var/log/procmail\.log.* -- gen_context(system_u:object_r:procmail_log_t,s0) -/var/log/procmail(/.*)? gen_context(system_u:object_r:procmail_log_t,s0)
policy/modules/services/procmail.if +61 -0
64 lines not on this page · raw message
policy/modules/services/procmail.te +7 -6
@@ -11,6 +11,9 @@ type procmail_exec_t; application_domain(procmail_t, procmail_exec_t) role system_r types procmail_t; +type procmail_home_t; +userdom_user_home_content(procmail_home_t) + type procmail_log_t; logging_log_file(procmail_log_t)
@@ -32,6 +35,8 @@ allow procmail_t self:udp_socket create_socket_perms; can_exec(procmail_t, procmail_exec_t) +procmail_read_user_content_files(procmail_t) + # Write log to /var/log/procmail.log or /var/log/procmail/.* allow procmail_t procmail_log_t:dir setattr; create_files_pattern(procmail_t, procmail_log_t, procmail_log_t)
@@ -81,12 +86,8 @@ logging_send_syslog_msg(procmail_t) miscfiles_read_localization(procmail_t) # only works until we define a different type for maildir -userdom_manage_user_home_content_dirs(procmail_t) -userdom_manage_user_home_content_files(procmail_t) -userdom_manage_user_home_content_symlinks(procmail_t) -userdom_manage_user_home_content_pipes(procmail_t) -userdom_manage_user_home_content_sockets(procmail_t) -userdom_user_home_dir_filetrans_user_home_content(procmail_t, { dir file lnk_file fifo_file sock_file }) +mta_manage_mail_home(procmail_t) +mta_user_home_filetrans_mail_home(procmail_t) # Do not audit attempts to access /root. userdom_dontaudit_search_user_home_dirs(procmail_t)
Signature · 9 lines
1.7.0.1 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100405/d5a66725/attachment.bin