diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index 3a82425685..a5bc99c7a8 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -716,7 +716,7 @@ optional_policy(`
')
optional_policy(`
- mta_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+ mta_admin_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
')
optional_policy(`
diff --git a/policy/modules/services/mta.if b/policy/modules/services/mta.if
index 01bca30bb5..928ca581b1 100644
--- a/policy/modules/services/mta.if
+++ b/policy/modules/services/mta.if
@@ -89,10 +89,14 @@ template(`mta_role',`
gen_require(`
attribute mta_user_agent;
attribute_role user_mail_roles;
- type user_mail_t, sendmail_exec_t, mail_home_t;
- type user_mail_tmp_t, mail_home_rw_t;
+ type sendmail_exec_t, mail_home_t;
+ type mail_home_rw_t;
')
+ mta_base_mail_template($1)
+ role $4 types $1_mail_t;
+ userdom_use_inherited_user_terminals($1_mail_t)
+
roleattribute $4 user_mail_roles;
# this is something i need to fix
@@ -100,26 +104,33 @@ template(`mta_role',`
# will role attribute work?
role $4 types mta_user_agent;
- domtrans_pattern($3, sendmail_exec_t, user_mail_t)
+ dev_read_sysfs($1_mail_t)
+
+ domtrans_pattern($3, sendmail_exec_t, $1_mail_t)
allow $3 sendmail_exec_t:lnk_file read_lnk_file_perms;
- allow $3 { user_mail_t mta_user_agent }:process { ptrace signal_perms };
- ps_process_pattern($3, { user_mail_t mta_user_agent })
+ allow $3 { $1_mail_t mta_user_agent }:process { ptrace signal_perms };
+ ps_process_pattern($3, { $1_mail_t mta_user_agent })
allow $2 mail_home_t:file { manage_file_perms relabel_file_perms };
+ manage_files_pattern($1_mail_t, mail_home_t, mail_home_t)
+
userdom_user_home_dir_filetrans($2, mail_home_t, file, ".esmtp_queue")
userdom_user_home_dir_filetrans($2, mail_home_t, file, ".forward")
userdom_user_home_dir_filetrans($2, mail_home_t, file, ".mailrc")
userdom_user_home_dir_filetrans($2, mail_home_t, file, "dead.letter")
+ userdom_user_home_dir_filetrans($1_mail_t, mail_home_t, file, ".esmtp_queue")
+ userdom_user_home_dir_filetrans($1_mail_t, mail_home_t, file, ".forward")
+ userdom_user_home_dir_filetrans($1_mail_t, mail_home_t, file, ".mailrc")
+ userdom_user_home_dir_filetrans($1_mail_t, mail_home_t, file, "dead.letter")
+
allow $2 mail_home_rw_t:dir { manage_dir_perms relabel_dir_perms };
allow $2 mail_home_rw_t:file { manage_file_perms relabel_file_perms };
allow $2 mail_home_rw_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
userdom_user_home_dir_filetrans($2, mail_home_rw_t, dir, "Maildir")
userdom_user_home_dir_filetrans($2, mail_home_rw_t, dir, ".maildir")
- allow $2 user_mail_tmp_t:dir { manage_dir_perms relabel_dir_perms };
- allow $2 user_mail_tmp_t:file { manage_file_perms relabel_file_perms };
optional_policy(`
exim_run($3, $4)
@@ -130,8 +141,54 @@ template(`mta_role',`
')
optional_policy(`
- systemd_user_app_status($1, user_mail_t)
+ allow $1_mail_t self:capability dac_override;
+
+ userdom_rw_user_tmp_files($1_mail_t)
+
+ postfix_read_config($1_mail_t)
+ postfix_list_spool($1_mail_t)
+ ')
+
+ optional_policy(`
+ systemd_user_app_status($1, $1_mail_t)
+ ')
+')
+
+########################################
+##
+## Role access for mta admin
+##
+##
+##
+## The prefix of the user role (e.g., user
+## is the prefix for user_r).
+##
+##
+##
+##
+## User domain for the role.
+##
+##
+##
+##
+## User exec domain for execute and transition access.
+##
+##
+##
+##
+## Role allowed access
+##
+##
+#
+template(`mta_admin_role',`
+ gen_require(`
+ type etc_aliases_t;
')
+
+ mta_role($1, $2, $3, $4)
+
+ files_etc_filetrans($1_mail_t, etc_aliases_t, file)
+ allow $1_mail_t etc_aliases_t:file manage_file_perms;
')
########################################
diff --git a/policy/modules/services/mta.te b/policy/modules/services/mta.te
index a4e3896a50..ab61dcc912 100644
--- a/policy/modules/services/mta.te
+++ b/policy/modules/services/mta.te
@@ -41,16 +41,6 @@ mta_agent_executable(sendmail_exec_t)
mta_base_mail_template(system)
role system_r types system_mail_t;
-mta_base_mail_template(user)
-userdom_user_application_type(user_mail_t)
-role user_mail_roles types user_mail_t;
-
-mta_base_mail_template(admin)
-userdom_user_application_type(admin_mail_t)
-role admin_mail_roles types admin_mail_t;
-
-userdom_user_tmp_file(user_mail_tmp_t)
-
########################################
#
# Common base mail policy
@@ -179,12 +169,6 @@ read_files_pattern(system_mail_t, etc_mail_t, etc_mail_t)
read_files_pattern(system_mail_t, mailcontent_type, mailcontent_type)
-allow system_mail_t mail_home_t:file manage_file_perms;
-userdom_user_home_dir_filetrans(system_mail_t, mail_home_t, file, ".esmtp_queue")
-userdom_user_home_dir_filetrans(system_mail_t, mail_home_t, file, ".forward")
-userdom_user_home_dir_filetrans(system_mail_t, mail_home_t, file, ".mailrc")
-userdom_user_home_dir_filetrans(system_mail_t, mail_home_t, file, "dead.letter")
-
allow system_mail_t user_mail_domain:dir list_dir_perms;
allow system_mail_t user_mail_domain:file read_file_perms;
allow system_mail_t user_mail_domain:lnk_file read_lnk_file_perms;
@@ -192,7 +176,6 @@ allow system_mail_t user_mail_domain:lnk_file read_lnk_file_perms;
corecmd_exec_shell(system_mail_t)
dev_read_rand(system_mail_t)
-dev_read_sysfs(system_mail_t)
fs_rw_anon_inodefs_files(system_mail_t)
@@ -204,8 +187,6 @@ init_use_script_ptys(system_mail_t)
init_use_fds(system_mail_t)
init_rw_stream_sockets(system_mail_t)
-userdom_use_user_terminals(system_mail_t)
-
optional_policy(`
apt_use_fds(system_mail_t)
apt_use_ptys(system_mail_t)
@@ -321,7 +302,7 @@ optional_policy(`
# MTA user agent local policy
#
-userdom_use_user_terminals(mta_user_agent)
+userdom_use_inherited_user_terminals(mta_user_agent)
optional_policy(`
apache_append_log(mta_user_agent)
@@ -410,54 +391,3 @@ optional_policy(`
optional_policy(`
uucp_domtrans_uux(mailserver_delivery)
')
-
-########################################
-#
-# User local policy
-#
-
-manage_files_pattern(user_mail_t, mail_home_t, mail_home_t)
-userdom_user_home_dir_filetrans(user_mail_t, mail_home_t, file, ".esmtp_queue")
-userdom_user_home_dir_filetrans(user_mail_t, mail_home_t, file, ".forward")
-userdom_user_home_dir_filetrans(user_mail_t, mail_home_t, file, ".mailrc")
-userdom_user_home_dir_filetrans(user_mail_t, mail_home_t, file, "dead.letter")
-
-dev_read_sysfs(user_mail_t)
-
-userdom_use_user_terminals(user_mail_t)
-
-optional_policy(`
- allow user_mail_t self:capability dac_override;
-
- userdom_rw_user_tmp_files(user_mail_t)
-
- postfix_read_config(user_mail_t)
- postfix_list_spool(user_mail_t)
-')
-
-########################################
-#
-# Admin local policy
-#
-
-manage_files_pattern(admin_mail_t, mail_home_t, mail_home_t)
-userdom_user_home_dir_filetrans(admin_mail_t, mail_home_t, file, ".esmtp_queue")
-userdom_user_home_dir_filetrans(admin_mail_t, mail_home_t, file, ".forward")
-userdom_user_home_dir_filetrans(admin_mail_t, mail_home_t, file, ".mailrc")
-userdom_user_home_dir_filetrans(admin_mail_t, mail_home_t, file, "dead.letter")
-
-dev_read_sysfs(admin_mail_t)
-
-userdom_use_user_terminals(admin_mail_t)
-
-files_etc_filetrans(admin_mail_t, etc_aliases_t, file)
-allow admin_mail_t etc_aliases_t:file manage_file_perms;
-
-optional_policy(`
- allow admin_mail_t self:capability dac_override;
-
- userdom_rw_user_tmp_files(admin_mail_t)
-
- postfix_read_config(admin_mail_t)
- postfix_list_spool(admin_mail_t)
-')
diff --git a/policy/modules/services/postfix.te b/policy/modules/services/postfix.te
index 60ecc4d124..c5ea2ed7eb 100644
--- a/policy/modules/services/postfix.te
+++ b/policy/modules/services/postfix.te
@@ -528,6 +528,9 @@ kernel_dontaudit_read_system_state(postfix_map_t)
dev_read_urand(postfix_map_t)
+domain_use_interactive_fds(postfix_map_t)
+userdom_use_inherited_user_terminals(postfix_map_t)
+
corenet_all_recvfrom_netlabel(postfix_map_t)
corenet_tcp_sendrecv_generic_if(postfix_map_t)
corenet_tcp_sendrecv_generic_node(postfix_map_t)
diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc
index 550e8661ff..5424f5d9c4 100644
--- a/policy/modules/system/libraries.fc
+++ b/policy/modules/system/libraries.fc
@@ -116,6 +116,7 @@ ifdef(`distro_debian',`
')
/usr/lib/postfix/lib.*so.* -- gen_context(system_u:object_r:lib_t,s0)
+/usr/lib/postfix/postfix.*so -- gen_context(system_u:object_r:lib_t,s0)
/usr/lib/altivec/libavcodec\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/cedega/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/dovecot/(.*/)?lib.*\.so.* -- gen_context(system_u:object_r:lib_t,s0)
diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
index 1c98f5e852..b6bcb09c64 100644
--- a/policy/modules/system/unconfined.te
+++ b/policy/modules/system/unconfined.te
@@ -167,7 +167,7 @@ optional_policy(`
')
optional_policy(`
- mta_role(unconfined, unconfined_t, unconfined_application_exec_domain, unconfined_r)
+ mta_admin_role(unconfined, unconfined_t, unconfined_application_exec_domain, unconfined_r)
')
optional_policy(`