[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     e807e322f5d1f639901069fd093036fc7c7ef666
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Sat Oct 13 17:45:09 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Oct 15 18:32:54 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=e807e322

Changes to the mta policy module and relevant dependencies

Remove some duplicate rules (already allowed by auth_use_nsswitch)
Change mta_etc_filetrans_aliases to be more flexible
Changes mta_sendmail_domtrans to use domtrans_pattern to simplify
Add back in mta_role caller role access to mta_user_agent types
Create mta_home_filetrans_home and home_rw, mta's will need it
Create mta manage mail home files and manage mail home rw content

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/mta.if      |  142 +++++++++++++++++++++++++++++++++++-
 policy/modules/contrib/mta.te      |    4 +-
 policy/modules/contrib/postfix.te  |    4 +-
 policy/modules/contrib/sendmail.if |    4 +
 policy/modules/contrib/sendmail.te |    6 +-
 5 files changed, 150 insertions(+), 10 deletions(-)

diff --git a/policy/modules/contrib/mta.if b/policy/modules/contrib/mta.if
index 6f3e458..6b27fb6 100644
--- a/policy/modules/contrib/mta.if
+++ b/policy/modules/contrib/mta.if
@@ -84,6 +84,11 @@ interface(`mta_role',`
 
 	roleattribute $1 user_mail_roles;
 
+	# this is something i need to fix
+	# i dont know if and why it is needed
+	# will role attribute work?
+	role $1 types mta_user_agent;
+
 	domtrans_pattern($2, sendmail_exec_t, user_mail_t)
 	allow $2 sendmail_exec_t:lnk_file read_lnk_file_perms;
 
@@ -156,6 +161,127 @@ interface(`mta_agent_executable',`
 	application_executable_file($1)
 ')
 
+#######################################
+## <summary>
+##	Read mta mail home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mta_read_mail_home_files',`
+	gen_require(`
+		type mail_home_t;
+	')
+
+	userdom_search_user_home_dirs($1)
+	allow $1 mail_home_t:file read_file_perms;
+')
+
+#######################################
+## <summary>
+##	Create, read, write, and delete
+##	mta mail home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mta_manage_mail_home_files',`
+	gen_require(`
+		type mail_home_t;
+	')
+
+	userdom_search_user_home_dirs($1)
+	allow $1 mail_home_t:file manage_file_perms;
+')
+
+########################################
+## <summary>
+##	Create specified objects in user home
+##	directories with the generic mail
+##	home type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	Class of the object being created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`mta_home_filetrans_home',`
+	gen_require(`
+		type mail_home_t;
+	')
+
+	userdom_user_home_dir_filetrans($1, mail_home_t, $2, $3)
+')
+
+#######################################
+## <summary>
+##	Create, read, write, and delete
+##	mta mail home rw content.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mta_manage_mail_home_rw_content',`
+	gen_require(`
+		type mail_home_rw_t;
+	')
+
+	userdom_search_user_home_dirs($1)
+	manage_dirs_pattern($1, mail_home_rw_t, mail_home_rw_t)
+	manage_files_pattern($1, mail_home_rw_t, mail_home_rw_t)
+	manage_lnk_files_pattern($1, mail_home_rw_t, mail_home_rw_t)
+')
+
+########################################
+## <summary>
+##	Create specified objects in user home
+##	directories with the generic mail
+##	home rw type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	Class of the object being created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`mta_home_filetrans_home_rw',`
+	gen_require(`
+		type mail_home_rw_t;
+	')
+
+	userdom_user_home_dir_filetrans($1, mail_home_rw_t, $2, $3)
+')
+
 ########################################
 ## <summary>
 ##	Make the specified type by a system MTA.
@@ -206,6 +332,7 @@ interface(`mta_sendmail_mailserver',`
 	')
 
 	init_system_domain($1, sendmail_exec_t)
+
 	typeattribute $1 mailserver_domain;
 ')
 
@@ -242,7 +369,6 @@ interface(`mta_mailserver_sender',`
 interface(`mta_mailserver_delivery',`
 	gen_require(`
 		attribute mailserver_delivery;
-		type mail_spool_t;
 	')
 
 	typeattribute $1 mailserver_delivery;
@@ -322,6 +448,8 @@ interface(`mta_sendmail_domtrans',`
 
 	corecmd_search_bin($1)
 	domain_auto_trans($1, sendmail_exec_t, $2)
+
+	allow $1 sendmail_exec_t:lnk_file read_lnk_file_perms;
 ')
 
 ########################################
@@ -459,13 +587,23 @@ interface(`mta_manage_aliases',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <param name="object">
+##	<summary>
+##	The object class of the object being created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`mta_etc_filetrans_aliases',`
 	gen_require(`
 		type etc_aliases_t;
 	')
 
-	files_etc_filetrans($1, etc_aliases_t, file)
+	files_etc_filetrans($1, etc_aliases_t, $2, $3)
 ')
 
 ########################################

diff --git a/policy/modules/contrib/mta.te b/policy/modules/contrib/mta.te
index 22ae59a..85f95f7 100644
--- a/policy/modules/contrib/mta.te
+++ b/policy/modules/contrib/mta.te
@@ -1,4 +1,4 @@
-policy_module(mta, 2.5.2)
+policy_module(mta, 2.5.3)
 
 ########################################
 #
@@ -57,7 +57,6 @@ userdom_user_tmp_file(user_mail_tmp_t)
 
 allow user_mail_domain self:capability { setuid setgid chown };
 allow user_mail_domain self:process { signal_perms setrlimit };
-allow user_mail_domain self:tcp_socket create_socket_perms;
 allow user_mail_domain self:fifo_file rw_fifo_file_perms;
 
 allow user_mail_domain mta_exec_type:file entrypoint;
@@ -96,7 +95,6 @@ dev_read_urand(user_mail_domain)
 
 domain_use_interactive_fds(user_mail_domain)
 
-files_read_etc_files(user_mail_domain)
 files_read_etc_runtime_files(user_mail_domain)
 files_read_usr_files(user_mail_domain)
 files_search_spool(user_mail_domain)

diff --git a/policy/modules/contrib/postfix.te b/policy/modules/contrib/postfix.te
index fd0fcd4..f07d1a5 100644
--- a/policy/modules/contrib/postfix.te
+++ b/policy/modules/contrib/postfix.te
@@ -1,4 +1,4 @@
-policy_module(postfix, 1.14.4)
+policy_module(postfix, 1.14.5)
 
 ########################################
 #
@@ -198,7 +198,7 @@ mta_getattr_spool(postfix_master_t)
 ifdef(`distro_redhat',`
 	# for newer main.cf that uses /etc/aliases
 	mta_manage_aliases(postfix_master_t)
-	mta_etc_filetrans_aliases(postfix_master_t)
+	mta_etc_filetrans_aliases(postfix_master_t, file)
 ')
 
 optional_policy(`

diff --git a/policy/modules/contrib/sendmail.if b/policy/modules/contrib/sendmail.if
index 7e94c7c..03bc4fe 100644
--- a/policy/modules/contrib/sendmail.if
+++ b/policy/modules/contrib/sendmail.if
@@ -267,6 +267,10 @@ interface(`sendmail_domtrans_unconfined',`
 	')
 
 	mta_sendmail_domtrans($1, unconfined_sendmail_t)
+
+	allow unconfined_sendmail_t $1:fd use;
+	allow unconfined_sendmail_t $1:fifo_file rw_file_perms;
+	allow unconfined_sendmail_t $1:process sigchld;
 ')
 
 ########################################

diff --git a/policy/modules/contrib/sendmail.te b/policy/modules/contrib/sendmail.te
index 22dac1f..6aeb742 100644
--- a/policy/modules/contrib/sendmail.te
+++ b/policy/modules/contrib/sendmail.te
@@ -1,4 +1,4 @@
-policy_module(sendmail, 1.11.0)
+policy_module(sendmail, 1.11.1)
 
 ########################################
 #
@@ -106,7 +106,7 @@ userdom_dontaudit_use_unpriv_user_fds(sendmail_t)
 userdom_dontaudit_search_user_home_dirs(sendmail_t)
 
 mta_read_config(sendmail_t)
-mta_etc_filetrans_aliases(sendmail_t)
+mta_etc_filetrans_aliases(sendmail_t, file)
 # Write to /etc/aliases and /etc/mail.
 mta_manage_aliases(sendmail_t)
 # Write to /var/spool/mail and /var/spool/mqueue.
@@ -182,6 +182,6 @@ optional_policy(`
 #
 
 optional_policy(`
-	mta_etc_filetrans_aliases(unconfined_sendmail_t)
+	mta_etc_filetrans_aliases(unconfined_sendmail_t, file)
 	unconfined_domain(unconfined_sendmail_t)
 ')