[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     811e85bf5d940e6a8891f383c3a8d447d9560cac
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Thu Oct 11 08:12:54 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Oct 11 16:00:44 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=811e85bf

Changes to the mailman policy module and relevant dependencies

Ported from Fedora with changes
Unify file context specifications
Declare type attribute and use that to write efficient common policy
Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/mailman.fc |   46 +++++++-------
 policy/modules/contrib/mailman.if |  126 +++++++++++++------------------------
 policy/modules/contrib/mailman.te |  119 +++++++++++++++++++++++++----------
 policy/modules/contrib/postfix.if |   19 ++++++
 policy/modules/contrib/postfix.te |    2 +-
 5 files changed, 175 insertions(+), 137 deletions(-)

diff --git a/policy/modules/contrib/mailman.fc b/policy/modules/contrib/mailman.fc
index 291f764..7fa381b 100644
--- a/policy/modules/contrib/mailman.fc
+++ b/policy/modules/contrib/mailman.fc
@@ -1,28 +1,30 @@
-/usr/lib/mailman/bin/mailmanctl	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)
-/usr/lib/mailman/cron/.*	--	gen_context(system_u:object_r:mailman_queue_exec_t,s0)
-
-/var/lib/mailman(/.*)?	gen_context(system_u:object_r:mailman_data_t,s0)
-/var/lib/mailman/archives(/.*)?	gen_context(system_u:object_r:mailman_archive_t,s0)
-/var/lock/mailman(/.*)?	gen_context(system_u:object_r:mailman_lock_t,s0)
-/var/log/mailman(/.*)?	gen_context(system_u:object_r:mailman_log_t,s0)
-/var/run/mailman(/.*)?	gen_context(system_u:object_r:mailman_lock_t,s0)
-
-ifdef(`distro_debian',`
 /etc/cron\.daily/mailman	--	gen_context(system_u:object_r:mailman_queue_exec_t,s0)
 /etc/cron\.monthly/mailman	--	gen_context(system_u:object_r:mailman_queue_exec_t,s0)
 
-/usr/lib/cgi-bin/mailman/.*	--	gen_context(system_u:object_r:mailman_cgi_exec_t,s0)
-/usr/lib/mailman/mail/wrapper	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)
-/usr/mailman/mail/wrapper	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)
-')
+/etc/mailman.*	gen_context(system_u:object_r:mailman_data_t,s0)
+
+/usr/lib/mailman.*/bin/mailmanctl	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)
+/usr/lib/mailman.*/bin/mm-handler.*	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)
+/usr/lib/mailman.*/cron/.*	--	gen_context(system_u:object_r:mailman_queue_exec_t,s0)
+/var/lib/mailman.*	gen_context(system_u:object_r:mailman_data_t,s0)
+/var/lib/mailman.*/archives(/.*)?	gen_context(system_u:object_r:mailman_archive_t,s0)
+
+/var/lock/mailman.*	gen_context(system_u:object_r:mailman_lock_t,s0)
+/var/lock/subsys/mailman.*	--	gen_context(system_u:object_r:mailman_lock_t,s0)
+
+/var/log/mailman.*	gen_context(system_u:object_r:mailman_log_t,s0)
+
+/var/run/mailman.*	gen_context(system_u:object_r:mailman_var_run_t,s0)
+
+/var/spool/mailman.*	gen_context(system_u:object_r:mailman_data_t,s0)
 
-ifdef(`distro_redhat',`
-/etc/mailman(/.*)?	gen_context(system_u:object_r:mailman_data_t,s0)
+/usr/lib/cgi-bin/mailman.*/.*	--	gen_context(system_u:object_r:mailman_cgi_exec_t,s0)
+/usr/lib/mailman.*/bin/qrunner	--	gen_context(system_u:object_r:mailman_queue_exec_t,s0)
+/usr/lib/mailman.*/cgi-bin/.*	--	gen_context(system_u:object_r:mailman_cgi_exec_t,s0)
+/usr/lib/mailman.*/mail/mailman	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)
+/usr/lib/mailman.*/mail/wrapper	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)
+/usr/lib/mailman.*/scripts/mailman	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)
 
-/usr/lib/mailman/bin/qrunner	--	gen_context(system_u:object_r:mailman_queue_exec_t,s0)
-/usr/lib/mailman/cgi-bin/.*	--	gen_context(system_u:object_r:mailman_cgi_exec_t,s0)
-/usr/lib/mailman/mail/mailman	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)
-/usr/lib/mailman/scripts/mailman	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)
+/usr/mailman.*/mail/wrapper	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)
 
-/var/spool/mailman(/.*)?	gen_context(system_u:object_r:mailman_data_t,s0)
-')
+/usr/share/doc/mailman.*/mm-handler.*	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)

diff --git a/policy/modules/contrib/mailman.if b/policy/modules/contrib/mailman.if
index 67c7fdd..f8debdc 100644
--- a/policy/modules/contrib/mailman.if
+++ b/policy/modules/contrib/mailman.if
@@ -1,93 +1,44 @@
-## <summary>Mailman is for managing electronic mail discussion and e-newsletter lists</summary>
+## <summary>Manage electronic mail discussion and e-newsletter lists.</summary>
 
 #######################################
 ## <summary>
-##	The template to define a mailmain domain.
+##	The template to define a mailman domain.
 ## </summary>
-## <desc>
-##	<p>
-##	This template creates a domain to be used for
-##	a new mailman daemon.
-##	</p>
-## </desc>
-## <param name="userdomain_prefix">
+## <param name="domain_prefix">
 ##	<summary>
-##	The type of daemon to be used eg, cgi would give mailman_cgi_
+##	Domain prefix to be used.
 ##	</summary>
 ## </param>
 #
-template(`mailman_domain_template', `
-	type mailman_$1_t;
-	domain_type(mailman_$1_t)
-	role system_r types mailman_$1_t;
+template(`mailman_domain_template',`
+	gen_require(`
+		attribute mailman_domain;
+	')
 
+	########################################
+	#
+	# Declarations
+	#
+
+	type mailman_$1_t;
 	type mailman_$1_exec_t;
+	domain_type(mailman_$1_t)
 	domain_entry_file(mailman_$1_t, mailman_$1_exec_t)
+	role system_r types mailman_$1_t;
 
 	type mailman_$1_tmp_t;
 	files_tmp_file(mailman_$1_tmp_t)
 
-	allow mailman_$1_t self:{ unix_stream_socket unix_dgram_socket } create_socket_perms;
-	allow mailman_$1_t self:tcp_socket create_stream_socket_perms;
-	allow mailman_$1_t self:udp_socket create_socket_perms;
-
-	files_search_spool(mailman_$1_t)
-
-	manage_dirs_pattern(mailman_$1_t, mailman_archive_t, mailman_archive_t)
-	manage_files_pattern(mailman_$1_t, mailman_archive_t, mailman_archive_t)
-	manage_lnk_files_pattern(mailman_$1_t, mailman_archive_t, mailman_archive_t)
-
-	manage_dirs_pattern(mailman_$1_t, mailman_data_t, mailman_data_t)
-	manage_files_pattern(mailman_$1_t, mailman_data_t, mailman_data_t)
-	manage_lnk_files_pattern(mailman_$1_t, mailman_data_t, mailman_data_t)
-
-	manage_files_pattern(mailman_$1_t, mailman_lock_t, mailman_lock_t)
-	files_lock_filetrans(mailman_$1_t, mailman_lock_t, file)
-
-	manage_files_pattern(mailman_$1_t, mailman_log_t, mailman_log_t)
-	logging_log_filetrans(mailman_$1_t, mailman_log_t, file)
+	####################################
+	#
+	# Policy
+	#
 
 	manage_dirs_pattern(mailman_$1_t, mailman_$1_tmp_t, mailman_$1_tmp_t)
 	manage_files_pattern(mailman_$1_t, mailman_$1_tmp_t, mailman_$1_tmp_t)
 	files_tmp_filetrans(mailman_$1_t, mailman_$1_tmp_t, { file dir })
 
-	kernel_read_kernel_sysctls(mailman_$1_t)
-	kernel_read_system_state(mailman_$1_t)
-
-	corenet_all_recvfrom_unlabeled(mailman_$1_t)
-	corenet_all_recvfrom_netlabel(mailman_$1_t)
-	corenet_tcp_sendrecv_generic_if(mailman_$1_t)
-	corenet_udp_sendrecv_generic_if(mailman_$1_t)
-	corenet_raw_sendrecv_generic_if(mailman_$1_t)
-	corenet_tcp_sendrecv_generic_node(mailman_$1_t)
-	corenet_udp_sendrecv_generic_node(mailman_$1_t)
-	corenet_raw_sendrecv_generic_node(mailman_$1_t)
-	corenet_tcp_sendrecv_all_ports(mailman_$1_t)
-	corenet_udp_sendrecv_all_ports(mailman_$1_t)
-	corenet_tcp_bind_generic_node(mailman_$1_t)
-	corenet_udp_bind_generic_node(mailman_$1_t)
-	corenet_tcp_connect_smtp_port(mailman_$1_t)
-	corenet_sendrecv_smtp_client_packets(mailman_$1_t)
-
-	fs_getattr_xattr_fs(mailman_$1_t)
-
-	corecmd_exec_all_executables(mailman_$1_t)
-
-	files_exec_etc_files(mailman_$1_t)
-	files_list_usr(mailman_$1_t)
-	files_list_var(mailman_$1_t)
-	files_list_var_lib(mailman_$1_t)
-	files_read_var_lib_symlinks(mailman_$1_t)
-	files_read_etc_runtime_files(mailman_$1_t)
-
 	auth_use_nsswitch(mailman_$1_t)
-
-	libs_exec_ld_so(mailman_$1_t)
-	libs_exec_lib_files(mailman_$1_t)
-
-	logging_send_syslog_msg(mailman_$1_t)
-
-	miscfiles_read_localization(mailman_$1_t)
 ')
 
 #######################################
@@ -105,6 +56,7 @@ interface(`mailman_domtrans',`
 		type mailman_mail_exec_t, mailman_mail_t;
 	')
 
+	libs_search_lib($1)
 	domtrans_pattern($1, mailman_mail_exec_t, mailman_mail_t)
 ')
 
@@ -124,6 +76,7 @@ interface(`mailman_domtrans_cgi',`
 		type mailman_cgi_exec_t, mailman_cgi_t;
 	')
 
+	libs_search_lib($1)
 	domtrans_pattern($1, mailman_cgi_exec_t, mailman_cgi_t)
 ')
 
@@ -142,12 +95,13 @@ interface(`mailman_exec',`
 		type mailman_mail_exec_t;
 	')
 
+	libs_search_lib($1)
 	can_exec($1, mailman_mail_exec_t)
 ')
 
 #######################################
 ## <summary>
-##	Send generic signals to the mailman cgi domain.
+##	Send generic signals to mailman cgi.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -165,7 +119,7 @@ interface(`mailman_signal_cgi',`
 
 #######################################
 ## <summary>
-##	Allow domain to search data directories.
+##	Search mailman data directories.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -178,12 +132,13 @@ interface(`mailman_search_data',`
 		type mailman_data_t;
 	')
 
+	files_search_spool($1)
 	allow $1 mailman_data_t:dir search_dir_perms;
 ')
 
 #######################################
 ## <summary>
-##	Allow domain to to read mailman data files.
+##	Read mailman data content.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -196,6 +151,7 @@ interface(`mailman_read_data_files',`
 		type mailman_data_t;
 	')
 
+	files_search_spool($1)
 	list_dirs_pattern($1, mailman_data_t, mailman_data_t)
 	read_files_pattern($1, mailman_data_t, mailman_data_t)
 	read_lnk_files_pattern($1, mailman_data_t, mailman_data_t)
@@ -203,8 +159,8 @@ interface(`mailman_read_data_files',`
 
 #######################################
 ## <summary>
-##	Allow domain to to create mailman data files
-##	and write the directory.
+##	Create, read, write, and delete
+##	mailman data files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -217,13 +173,14 @@ interface(`mailman_manage_data_files',`
 		type mailman_data_t;
 	')
 
+	files_search_spool($1)
 	manage_dirs_pattern($1, mailman_data_t, mailman_data_t)
 	manage_files_pattern($1, mailman_data_t, mailman_data_t)
 ')
 
 #######################################
 ## <summary>
-##	List the contents of mailman data directories.
+##	List mailman data directories.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -236,12 +193,13 @@ interface(`mailman_list_data',`
 		type mailman_data_t;
 	')
 
+	files_search_spool($1)
 	allow $1 mailman_data_t:dir list_dir_perms;
 ')
 
 #######################################
 ## <summary>
-##	Allow read acces to mailman data symbolic links.
+##	Read mailman data symbolic links.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -259,7 +217,7 @@ interface(`mailman_read_data_symlinks',`
 
 #######################################
 ## <summary>
-##	Read mailman logs.
+##	Read mailman log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -272,12 +230,13 @@ interface(`mailman_read_log',`
 		type mailman_log_t;
 	')
 
+	logging_search_logs($1)
 	read_files_pattern($1, mailman_log_t, mailman_log_t)
 ')
 
 #######################################
 ## <summary>
-##	Append to mailman logs.
+##	Append mailman log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -290,13 +249,14 @@ interface(`mailman_append_log',`
 		type mailman_log_t;
 	')
 
+	logging_search_logs($1)
 	append_files_pattern($1, mailman_log_t, mailman_log_t)
 ')
 
 #######################################
 ## <summary>
 ##	Create, read, write, and delete
-##	mailman logs.
+##	mailman log content.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -309,13 +269,14 @@ interface(`mailman_manage_log',`
 		type mailman_log_t;
 	')
 
+	logging_search_logs($1)
 	manage_files_pattern($1, mailman_log_t, mailman_log_t)
 	manage_lnk_files_pattern($1, mailman_log_t, mailman_log_t)
 ')
 
 #######################################
 ## <summary>
-##	Allow domain to read mailman archive files.
+##	Read mailman archive content.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -328,6 +289,7 @@ interface(`mailman_read_archive',`
 		type mailman_archive_t;
 	')
 
+	files_search_var_lib($1)
 	allow $1 mailman_archive_t:dir list_dir_perms;
 	read_files_pattern($1, mailman_archive_t, mailman_archive_t)
 	read_lnk_files_pattern($1, mailman_archive_t, mailman_archive_t)
@@ -335,7 +297,8 @@ interface(`mailman_read_archive',`
 
 #######################################
 ## <summary>
-##	Execute mailman_queue in the mailman_queue domain.
+##	Execute mailman_queue in the
+##	mailman_queue domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -348,5 +311,6 @@ interface(`mailman_domtrans_queue',`
 		type mailman_queue_exec_t, mailman_queue_t;
 	')
 
+	libs_search_lib($1)
 	domtrans_pattern($1, mailman_queue_exec_t, mailman_queue_t)
 ')

diff --git a/policy/modules/contrib/mailman.te b/policy/modules/contrib/mailman.te
index 22265f0..de552ce 100644
--- a/policy/modules/contrib/mailman.te
+++ b/policy/modules/contrib/mailman.te
@@ -1,10 +1,12 @@
-policy_module(mailman, 1.9.0)
+policy_module(mailman, 1.9.1)
 
 ########################################
 #
 # Declarations
 #
 
+attribute mailman_domain;
+
 mailman_domain_template(cgi)
 
 type mailman_data_t;
@@ -19,6 +21,9 @@ logging_log_file(mailman_log_t)
 type mailman_lock_t;
 files_lock_file(mailman_lock_t)
 
+type mailman_var_run_t;
+files_pid_file(mailman_var_run_t)
+
 mailman_domain_template(mail)
 init_daemon_domain(mailman_mail_t, mailman_mail_exec_t)
 
@@ -26,28 +31,70 @@ mailman_domain_template(queue)
 
 ########################################
 #
-# Mailman CGI local policy
+# Common local policy
 #
 
-# cjp: the template invocation for cgi should be
-# in the below optional policy; however, there are no
-# optionals for file contexts yet, so it is promoted
-# to global scope until such facilities exist.
+allow mailman_domain self:tcp_socket { accept listen };
 
-optional_policy(`
-	dev_read_urand(mailman_cgi_t)
+manage_dirs_pattern(mailman_domain, mailman_archive_t, mailman_archive_t)
+manage_files_pattern(mailman_domain, mailman_archive_t, mailman_archive_t)
+manage_lnk_files_pattern(mailman_domain, mailman_archive_t, mailman_archive_t)
+
+manage_dirs_pattern(mailman_domain, mailman_data_t, mailman_data_t)
+manage_files_pattern(mailman_domain, mailman_data_t, mailman_data_t)
+manage_lnk_files_pattern(mailman_domain, mailman_data_t, mailman_data_t)
+
+manage_files_pattern(mailman_domain, mailman_lock_t, mailman_lock_t)
+files_lock_filetrans(mailman_domain, mailman_lock_t, file)
+
+append_files_pattern(mailman_domain, mailman_log_t, mailman_log_t)
+create_files_pattern(mailman_domain, mailman_log_t, mailman_log_t)
+setattr_files_pattern(mailman_domain, mailman_log_t, mailman_log_t)
+logging_log_filetrans(mailman_domain, mailman_log_t, file)
+
+kernel_read_kernel_sysctls(mailman_domain)
+kernel_read_system_state(mailman_domain)
+
+corenet_all_recvfrom_unlabeled(mailman_domain)
+corenet_all_recvfrom_netlabel(mailman_domain)
+corenet_tcp_sendrecv_generic_if(mailman_domain)
+corenet_tcp_sendrecv_generic_node(mailman_domain)
+
+corenet_sendrecv_smtp_client_packets(mailman_domain)
+corenet_tcp_connect_smtp_port(mailman_domain)
+corenet_tcp_sendrecv_smtp_port(mailman_domain)
+
+corecmd_exec_all_executables(mailman_domain)
+
+files_exec_etc_files(mailman_domain)
+files_list_usr(mailman_domain)
+files_list_var(mailman_domain)
+files_list_var_lib(mailman_domain)
+files_read_var_lib_symlinks(mailman_domain)
+files_read_etc_runtime_files(mailman_domain)
+files_search_spool(mailman_domain)
+
+fs_getattr_all_fs(mailman_domain)
+
+libs_exec_ld_so(mailman_domain)
+libs_exec_lib_files(mailman_domain)
+
+logging_send_syslog_msg(mailman_domain)
 
-	manage_dirs_pattern(mailman_cgi_t, mailman_archive_t, mailman_archive_t)
-	manage_files_pattern(mailman_cgi_t, mailman_archive_t, mailman_archive_t)
-	manage_lnk_files_pattern(mailman_cgi_t, mailman_archive_t, mailman_archive_t)
+miscfiles_read_localization(mailman_domain)
 
-	files_search_spool(mailman_cgi_t)
+########################################
+#
+# CGI local policy
+#
+
+dev_read_urand(mailman_cgi_t)
 
-	term_use_controlling_term(mailman_cgi_t)
+term_use_controlling_term(mailman_cgi_t)
 
-	# for python pre-compile foolishness
-	libs_dontaudit_write_lib_dirs(mailman_cgi_t)
+libs_dontaudit_write_lib_dirs(mailman_cgi_t)
 
+optional_policy(`
 	apache_sigchld(mailman_cgi_t)
 	apache_use_fds(mailman_cgi_t)
 	apache_dontaudit_append_log(mailman_cgi_t)
@@ -56,20 +103,31 @@ optional_policy(`
 	apache_dontaudit_rw_stream_sockets(mailman_cgi_t)
 ')
 
+optional_policy(`
+	postfix_read_config(mailman_cgi_t)
+')
+
 ########################################
 #
-# Mailman mail local policy
+# Mail local policy
 #
 
-allow mailman_mail_t self:unix_dgram_socket create_socket_perms;
-allow mailman_mail_t self:process { signal signull };
 allow mailman_mail_t self:capability { kill dac_override setuid setgid sys_tty_config };
+allow mailman_mail_t self:process { signal signull };
+
+manage_files_pattern(mailman_mail_t, mailman_var_run_t, mailman_var_run_t)
+manage_dirs_pattern(mailman_mail_t, mailman_var_run_t, mailman_var_run_t)
+files_pid_filetrans(mailman_mail_t, mailman_var_run_t, { file dir })
 
-manage_dirs_pattern(mailman_mail_t, mailman_archive_t, mailman_archive_t)
-manage_files_pattern(mailman_mail_t, mailman_archive_t, mailman_archive_t)
-manage_lnk_files_pattern(mailman_mail_t, mailman_archive_t, mailman_archive_t)
+corenet_sendrecv_innd_client_packets(mailman_mail_t)
+corenet_tcp_connect_innd_port(mailman_mail_t)
+corenet_tcp_sendrecv_innd_port(mailman_mail_t)
 
-files_search_spool(mailman_mail_t)
+corenet_sendrecv_spamd_client_packets(mailman_mail_t)
+corenet_tcp_connect_spamd_port(mailman_mail_t)
+corenet_tcp_sendrecv_spamd_port(mailman_mail_t)
+
+dev_read_urand(mailman_mail_t)
 
 fs_rw_anon_inodefs_files(mailman_mail_t)
 
@@ -86,33 +144,28 @@ optional_policy(`
 
 optional_policy(`
 	postfix_search_spool(mailman_mail_t)
+	postfix_rw_master_pipes(mailman_mail_t)
 ')
 
 ########################################
 #
-# Mailman queue local policy
+# Queue local policy
 #
 
 allow mailman_queue_t self:capability { setgid setuid };
 allow mailman_queue_t self:process signal;
 allow mailman_queue_t self:fifo_file rw_fifo_file_perms;
-allow mailman_queue_t self:unix_dgram_socket create_socket_perms;
-
-manage_dirs_pattern(mailman_queue_t, mailman_archive_t, mailman_archive_t)
-manage_files_pattern(mailman_queue_t, mailman_archive_t, mailman_archive_t)
-manage_lnk_files_pattern(mailman_queue_t, mailman_archive_t, mailman_archive_t)
 
-kernel_read_proc_symlinks(mailman_queue_t)
+corenet_sendrecv_innd_client_packets(mailman_queue_t)
+corenet_tcp_connect_innd_port(mailman_queue_t)
+corenet_tcp_sendrecv_innd_port(mailman_queue_t)
 
 auth_domtrans_chk_passwd(mailman_queue_t)
 
 files_dontaudit_search_pids(mailman_queue_t)
 
-# for su
 seutil_dontaudit_search_config(mailman_queue_t)
 
-# some of the following could probably be changed to dontaudit, someone who
-# knows mailman well should test this out and send the changes
 userdom_search_user_home_dirs(mailman_queue_t)
 
 optional_policy(`
@@ -125,4 +178,4 @@ optional_policy(`
 
 optional_policy(`
 	su_exec(mailman_queue_t)
-')
\ No newline at end of file
+')

diff --git a/policy/modules/contrib/postfix.if b/policy/modules/contrib/postfix.if
index bfc9b03..2ab9765 100644
--- a/policy/modules/contrib/postfix.if
+++ b/policy/modules/contrib/postfix.if
@@ -453,6 +453,25 @@ interface(`postfix_stream_connect_master',`
 
 ########################################
 ## <summary>
+##	Read and write postfix master
+##	unnamed pipes,
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`postfix_rw_master_pipes',`
+	gen_require(`
+		type postfix_master_t;
+	')
+
+	allow $1 postfix_master_t:fifo_file { read write };
+')
+
+########################################
+## <summary>
 ##	Execute the master postdrop in the
 ##	postfix_postdrop domain.
 ## </summary>

diff --git a/policy/modules/contrib/postfix.te b/policy/modules/contrib/postfix.te
index f5fc98a..fd0fcd4 100644
--- a/policy/modules/contrib/postfix.te
+++ b/policy/modules/contrib/postfix.te
@@ -1,4 +1,4 @@
-policy_module(postfix, 1.14.3)
+policy_module(postfix, 1.14.4)
 
 ########################################
 #