Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: trivial mail server patch
To:     russell@coker.com.au,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
References: <2790872.6eiCcbVEAQ@xev>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <dce05326-5a6d-ed01-9f1a-dadd1bb99419@ieee.org>
Date:   Sun, 16 Feb 2020 10:23:56 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.3.1
MIME-Version: 1.0
In-Reply-To: <2790872.6eiCcbVEAQ@xev>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 2/11/20 10:13 PM, Russell Coker wrote:
> This patch against git refpolicy has a bunch of trivial patches related to
> mail servers.  I think it's ready for merging.

Please inline patch and add signed-off-by

> --- refpolicy-2.20200209.orig/policy/modules/services/mailman.fc
> +++ refpolicy-2.20200209/policy/modules/services/mailman.fc
> @@ -23,6 +23,7 @@
>  /usr/lib/mailman/mail/mailman	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)
>  /usr/lib/mailman/mail/wrapper	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)
>  /usr/lib/mailman/scripts/mailman	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)
> +/etc/mailman/postfix-to-mailman.py	--	gen_context(system_u:object_r:mailman_mail_exec_t,s0)

Please move up with other /etc lines.


> --- refpolicy-2.20200209.orig/policy/modules/services/mta.if
> +++ refpolicy-2.20200209/policy/modules/services/mta.if
> @@ -251,6 +251,7 @@ interface(`mta_manage_mail_home_rw_conte
>  	userdom_search_user_home_dirs($1)
>  	manage_dirs_pattern($1, mail_home_rw_t, mail_home_rw_t)
>  	manage_files_pattern($1, mail_home_rw_t, mail_home_rw_t)
> +	allow $1 mail_home_rw_t:file map;
>  	manage_lnk_files_pattern($1, mail_home_rw_t, mail_home_rw_t)
>  ')
>  
> @@ -867,6 +868,7 @@ interface(`mta_read_spool_files',`
>  
>  	files_search_spool($1)
>  	read_files_pattern($1, mail_spool_t, mail_spool_t)
> +	allow $1 mail_spool_t:file map;
>  ')
>  
>  ########################################
> @@ -949,6 +951,7 @@ interface(`mta_manage_spool',`
>  	files_search_spool($1)
>  	manage_dirs_pattern($1, mail_spool_t, mail_spool_t)
>  	manage_files_pattern($1, mail_spool_t, mail_spool_t)
> +	allow $1 mail_spool_t:file map;
>  	manage_lnk_files_pattern($1, mail_spool_t, mail_spool_t)
>  ')

So you're saying that in general these files are all mmaped?


> Index: refpolicy-2.20200209/policy/modules/services/spamassassin.if
> ===================================================================
> --- refpolicy-2.20200209.orig/policy/modules/services/spamassassin.if
> +++ refpolicy-2.20200209/policy/modules/services/spamassassin.if
> @@ -433,3 +433,22 @@ interface(`spamassassin_admin',`
>  	# sa-update
>  	spamassassin_run_update($1, $2)
>  ')
> +
> +########################################
> +## <summary>
> +##	Get SA service status
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +## <rolecap/>
> +#
> +interface(`spamassassin_service_reload',`
> +	gen_require(`
> +		type spamassassin_unit_t;
> +	')
> +
> +	allow $1 spamassassin_unit_t:service { status reload };
> +')

Need 2 interfaces

> Index: refpolicy-2.20200209/policy/modules/services/spamassassin.te
> ===================================================================
> --- refpolicy-2.20200209.orig/policy/modules/services/spamassassin.te
> +++ refpolicy-2.20200209/policy/modules/services/spamassassin.te
> @@ -22,6 +22,7 @@ gen_tunable(spamassassin_can_network, fa
>  gen_tunable(spamd_enable_home_dirs, false)
>  
>  type spamd_update_t;
> +typealias spamd_update_t alias { spamd_gpg_t };
>  type spamd_update_exec_t;
>  init_system_domain(spamd_update_t, spamd_update_exec_t)
>  
> @@ -62,9 +63,6 @@ files_type(spamd_compiled_t)
>  type spamd_etc_t;
>  files_config_file(spamd_etc_t)
>  
> -type spamd_gpg_t;
> -domain_type(spamd_gpg_t)

Why are you dropping this?


-- 
Chris PeBenito