Adds a separate context for courier spooling dirs/files and a few new interfaces. Originally sent on Jul 19, received no comments, refreshed patch only Index: refpolicy/policy/modules/services/courier.fc =================================================================== --- refpolicy.orig/policy/modules/services/courier.fc 2008-08-03 13:09:39.000000000 +0200 +++ refpolicy/policy/modules/services/courier.fc 2008-08-03 17:04:59.000000000 +0200 @@ -19,3 +19,5 @@ /var/lib/courier(/.*)? -- gen_context(system_u:object_r:courier_var_lib_t,s0) /var/run/courier(/.*)? -- gen_context(system_u:object_r:courier_var_run_t,s0) + +/var/spool/courier(/.*)? gen_context(system_u:object_r:courier_spool_t,s0) Index: refpolicy/policy/modules/services/courier.if =================================================================== --- refpolicy.orig/policy/modules/services/courier.if 2008-08-03 16:47:00.000000000 +0200 +++ refpolicy/policy/modules/services/courier.if 2008-08-03 17:05:41.000000000 +0200 @@ -123,3 +123,77 @@ domtrans_pattern($1, courier_pop_exec_t, courier_pop_t) ') + + +######################################## +## <summary> +## Allow domain to read courier config files +## </summary> +## <param name="prefix"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`courier_read_config',` + gen_require(` + type courier_etc_t; + ') + + read_files_pattern($1, courier_etc_t, courier_etc_t) +') + +######################################## +## <summary> +## Allow domain to manage courier spool directories +## </summary> +## <param name="prefix"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`courier_manage_spool_dirs',` + gen_require(` + type courier_spool_t; + ') + + manage_dirs_pattern($1, courier_spool_t, courier_spool_t) +') + +######################################## +## <summary> +## Allow domain to manage courier spool files +## </summary> +## <param name="prefix"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`courier_manage_spool_files',` + gen_require(` + type courier_spool_t; + ') + + manage_files_pattern($1, courier_spool_t, courier_spool_t) +') + +######################################## +## <summary> +## Allow attempts to read and write to +## courier unnamed pipes. +## </summary> +## <param name="domain"> +## <summary> +## Domain to not audit. +## </summary> +## </param> +# +interface(`courier_rw_pipes',` + gen_require(` + type courier_spool_t; + ') + + allow $1 courier_spool_t:fifo_file rw_fifo_file_perms; +') Index: refpolicy/policy/modules/services/courier.te =================================================================== --- refpolicy.orig/policy/modules/services/courier.te 2008-08-03 16:47:00.000000000 +0200 +++ refpolicy/policy/modules/services/courier.te 2008-08-03 17:04:59.000000000 +0200 @@ -9,7 +9,10 @@ courier_domain_template(authdaemon) type courier_etc_t; -files_type(courier_etc_t) +files_config_file(courier_etc_t) + +type courier_spool_t; +files_type(courier_spool_t) courier_domain_template(pcp) @@ -25,6 +28,7 @@ type courier_exec_t; files_type(courier_exec_t) +mta_mailclient(courier_exec_t) courier_domain_template(sqwebmail) typealias courier_sqwebmail_exec_t alias sqwebmail_cron_exec_t; @@ -97,12 +101,12 @@ courier_domtrans_authdaemon(courier_pop_t) # do the actual work (read the Maildir) -userdom_manage_unpriv_users_home_content_files(courier_pop_t) +unprivuser_manage_home_content_files(courier_pop_t) # cjp: the fact that this is different for pop vs imap means that # there should probably be a courier_pop_t and courier_imap_t # this should also probably be a separate type too instead of # the regular home dir -userdom_manage_unpriv_users_home_content_dirs(courier_pop_t) +unprivuser_manage_home_content_dirs(courier_pop_t) ######################################## # -- David Härdeman -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
