Skip to content

mail domains #1146

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
etbe wants to merge 3 commits into
base: main
Choose a base branch
from
Open

mail domains #1146

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
72ae8b0
Mail sendmail run in domains such as sysadm_mail_t and also allow
etbe Jun 6, 2026
56d4c39
Fix the build errors from the previous one and cleaned it up
etbe Jun 6, 2026
e32e668
Removed the misuse of user_mail_tmp_t
etbe Jun 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion policy/modules/roles/sysadm.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -716,7 +716,7 @@ optional_policy(`
')

optional_policy(`
mta_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
mta_admin_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
')

optional_policy(`
Expand Down
73 changes: 65 additions & 8 deletions policy/modules/services/mta.if
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,37 +89,48 @@ template(`mta_role',`
gen_require(`
attribute mta_user_agent;
attribute_role user_mail_roles;
type user_mail_t, sendmail_exec_t, mail_home_t;
type user_mail_tmp_t, mail_home_rw_t;
type sendmail_exec_t, mail_home_t;
type mail_home_rw_t;
')

mta_base_mail_template($1)
role $4 types $1_mail_t;
userdom_use_inherited_user_terminals($1_mail_t)

roleattribute $4 user_mail_roles;

# this is something i need to fix
# i dont know if and why it is needed
# will role attribute work?
role $4 types mta_user_agent;

domtrans_pattern($3, sendmail_exec_t, user_mail_t)
dev_read_sysfs($1_mail_t)

domtrans_pattern($3, sendmail_exec_t, $1_mail_t)
allow $3 sendmail_exec_t:lnk_file read_lnk_file_perms;

allow $3 { user_mail_t mta_user_agent }:process { ptrace signal_perms };
ps_process_pattern($3, { user_mail_t mta_user_agent })
allow $3 { $1_mail_t mta_user_agent }:process { ptrace signal_perms };
ps_process_pattern($3, { $1_mail_t mta_user_agent })

allow $2 mail_home_t:file { manage_file_perms relabel_file_perms };
manage_files_pattern($1_mail_t, mail_home_t, mail_home_t)

userdom_user_home_dir_filetrans($2, mail_home_t, file, ".esmtp_queue")
userdom_user_home_dir_filetrans($2, mail_home_t, file, ".forward")
userdom_user_home_dir_filetrans($2, mail_home_t, file, ".mailrc")
userdom_user_home_dir_filetrans($2, mail_home_t, file, "dead.letter")

userdom_user_home_dir_filetrans($1_mail_t, mail_home_t, file, ".esmtp_queue")
userdom_user_home_dir_filetrans($1_mail_t, mail_home_t, file, ".forward")
userdom_user_home_dir_filetrans($1_mail_t, mail_home_t, file, ".mailrc")
userdom_user_home_dir_filetrans($1_mail_t, mail_home_t, file, "dead.letter")

allow $2 mail_home_rw_t:dir { manage_dir_perms relabel_dir_perms };
allow $2 mail_home_rw_t:file { manage_file_perms relabel_file_perms };
allow $2 mail_home_rw_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
userdom_user_home_dir_filetrans($2, mail_home_rw_t, dir, "Maildir")
userdom_user_home_dir_filetrans($2, mail_home_rw_t, dir, ".maildir")

allow $2 user_mail_tmp_t:dir { manage_dir_perms relabel_dir_perms };
allow $2 user_mail_tmp_t:file { manage_file_perms relabel_file_perms };

optional_policy(`
exim_run($3, $4)
Expand All @@ -130,8 +141,54 @@ template(`mta_role',`
')

optional_policy(`
systemd_user_app_status($1, user_mail_t)
allow $1_mail_t self:capability dac_override;

userdom_rw_user_tmp_files($1_mail_t)

postfix_read_config($1_mail_t)
postfix_list_spool($1_mail_t)
')

optional_policy(`
systemd_user_app_status($1, $1_mail_t)
')
')

########################################
## <summary>
## Role access for mta admin
## </summary>
## <param name="role_prefix">
## <summary>
## The prefix of the user role (e.g., user
## is the prefix for user_r).
## </summary>
## </param>
## <param name="user_domain">
## <summary>
## User domain for the role.
## </summary>
## </param>
## <param name="user_exec_domain">
## <summary>
## User exec domain for execute and transition access.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access
## </summary>
## </param>
#
template(`mta_admin_role',`
gen_require(`
type etc_aliases_t;
')

mta_role($1, $2, $3, $4)

files_etc_filetrans($1_mail_t, etc_aliases_t, file)
allow $1_mail_t etc_aliases_t:file manage_file_perms;
')

########################################
Expand Down
72 changes: 1 addition & 71 deletions policy/modules/services/mta.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,16 +41,6 @@ mta_agent_executable(sendmail_exec_t)
mta_base_mail_template(system)
role system_r types system_mail_t;

mta_base_mail_template(user)
userdom_user_application_type(user_mail_t)
role user_mail_roles types user_mail_t;

mta_base_mail_template(admin)
userdom_user_application_type(admin_mail_t)
role admin_mail_roles types admin_mail_t;

userdom_user_tmp_file(user_mail_tmp_t)

########################################
#
# Common base mail policy
Expand Down Expand Up @@ -179,20 +169,13 @@ read_files_pattern(system_mail_t, etc_mail_t, etc_mail_t)

read_files_pattern(system_mail_t, mailcontent_type, mailcontent_type)

allow system_mail_t mail_home_t:file manage_file_perms;
userdom_user_home_dir_filetrans(system_mail_t, mail_home_t, file, ".esmtp_queue")
userdom_user_home_dir_filetrans(system_mail_t, mail_home_t, file, ".forward")
userdom_user_home_dir_filetrans(system_mail_t, mail_home_t, file, ".mailrc")
userdom_user_home_dir_filetrans(system_mail_t, mail_home_t, file, "dead.letter")

allow system_mail_t user_mail_domain:dir list_dir_perms;
allow system_mail_t user_mail_domain:file read_file_perms;
allow system_mail_t user_mail_domain:lnk_file read_lnk_file_perms;

corecmd_exec_shell(system_mail_t)

dev_read_rand(system_mail_t)
dev_read_sysfs(system_mail_t)

fs_rw_anon_inodefs_files(system_mail_t)

Expand All @@ -204,8 +187,6 @@ init_use_script_ptys(system_mail_t)
init_use_fds(system_mail_t)
init_rw_stream_sockets(system_mail_t)

userdom_use_user_terminals(system_mail_t)

optional_policy(`
apt_use_fds(system_mail_t)
apt_use_ptys(system_mail_t)
Expand Down Expand Up @@ -321,7 +302,7 @@ optional_policy(`
# MTA user agent local policy
#

userdom_use_user_terminals(mta_user_agent)
userdom_use_inherited_user_terminals(mta_user_agent)

optional_policy(`
apache_append_log(mta_user_agent)
Expand Down Expand Up @@ -410,54 +391,3 @@ optional_policy(`
optional_policy(`
uucp_domtrans_uux(mailserver_delivery)
')

########################################
#
# User local policy
#

manage_files_pattern(user_mail_t, mail_home_t, mail_home_t)
userdom_user_home_dir_filetrans(user_mail_t, mail_home_t, file, ".esmtp_queue")
userdom_user_home_dir_filetrans(user_mail_t, mail_home_t, file, ".forward")
userdom_user_home_dir_filetrans(user_mail_t, mail_home_t, file, ".mailrc")
userdom_user_home_dir_filetrans(user_mail_t, mail_home_t, file, "dead.letter")

dev_read_sysfs(user_mail_t)

userdom_use_user_terminals(user_mail_t)

optional_policy(`
allow user_mail_t self:capability dac_override;

userdom_rw_user_tmp_files(user_mail_t)

postfix_read_config(user_mail_t)
postfix_list_spool(user_mail_t)
')

########################################
#
# Admin local policy
#

manage_files_pattern(admin_mail_t, mail_home_t, mail_home_t)
userdom_user_home_dir_filetrans(admin_mail_t, mail_home_t, file, ".esmtp_queue")
userdom_user_home_dir_filetrans(admin_mail_t, mail_home_t, file, ".forward")
userdom_user_home_dir_filetrans(admin_mail_t, mail_home_t, file, ".mailrc")
userdom_user_home_dir_filetrans(admin_mail_t, mail_home_t, file, "dead.letter")

dev_read_sysfs(admin_mail_t)

userdom_use_user_terminals(admin_mail_t)

files_etc_filetrans(admin_mail_t, etc_aliases_t, file)
allow admin_mail_t etc_aliases_t:file manage_file_perms;

optional_policy(`
allow admin_mail_t self:capability dac_override;

userdom_rw_user_tmp_files(admin_mail_t)

postfix_read_config(admin_mail_t)
postfix_list_spool(admin_mail_t)
')
3 changes: 3 additions & 0 deletions policy/modules/services/postfix.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -528,6 +528,9 @@ kernel_dontaudit_read_system_state(postfix_map_t)

dev_read_urand(postfix_map_t)

domain_use_interactive_fds(postfix_map_t)
userdom_use_inherited_user_terminals(postfix_map_t)

corenet_all_recvfrom_netlabel(postfix_map_t)
corenet_tcp_sendrecv_generic_if(postfix_map_t)
corenet_tcp_sendrecv_generic_node(postfix_map_t)
Expand Down
1 change: 1 addition & 0 deletions policy/modules/system/libraries.fc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,7 @@ ifdef(`distro_debian',`
')

/usr/lib/postfix/lib.*so.* -- gen_context(system_u:object_r:lib_t,s0)
/usr/lib/postfix/postfix.*so -- gen_context(system_u:object_r:lib_t,s0)
/usr/lib/altivec/libavcodec\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/cedega/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/dovecot/(.*/)?lib.*\.so.* -- gen_context(system_u:object_r:lib_t,s0)
Expand Down
2 changes: 1 addition & 1 deletion policy/modules/system/unconfined.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,7 +167,7 @@ optional_policy(`
')

optional_policy(`
mta_role(unconfined, unconfined_t, unconfined_application_exec_domain, unconfined_r)
mta_admin_role(unconfined, unconfined_t, unconfined_application_exec_domain, unconfined_r)
')

optional_policy(`
Expand Down
Loading