Allow amavis_t to tcp connect to smtp_beforequeue_port_t and allow amavis_t to send and
receive smtp_beforequeue client packets.
Remove redundant policy that allows amavis to tcp send and receive to and from amavis send and recv
ports. Amavis already is allowed to tcp send and receive to and from all ports.
Remove policy that allows amavis_t to tcp connect to amavisd_send_port_t since it was
replaced by smtp_beforequeue_port_t.
Signed-off-by: Dominick Grift <[email protected]>
---
:100644 100644 ee09816... 0d0e3da... M policy/modules/services/amavis.te
policy/modules/services/amavis.te | 7 ++-----
1 files changed, 2 insertions(+), 5 deletions(-)
diff --git a/policy/modules/services/amavis.te b/policy/modules/services/amavis.te
index ee09816..0d0e3da 100644
--- a/policy/modules/services/amavis.te
+++ b/policy/modules/services/amavis.te
@@ -108,17 +108,14 @@ corecmd_exec_bin(amavis_t)
corenet_all_recvfrom_unlabeled(amavis_t)
corenet_all_recvfrom_netlabel(amavis_t)
+corenet_sendrecv_smtp_beforequeue_client_packets(amavis_t)
corenet_tcp_sendrecv_generic_if(amavis_t)
corenet_tcp_sendrecv_generic_node(amavis_t)
corenet_tcp_bind_generic_node(amavis_t)
corenet_udp_bind_generic_node(amavis_t)
-# amavis uses well-defined ports
-corenet_tcp_sendrecv_amavisd_recv_port(amavis_t)
-corenet_tcp_sendrecv_amavisd_send_port(amavis_t)
-# just the other side not. ;-)
corenet_tcp_sendrecv_all_ports(amavis_t)
# connect to backchannel port
-corenet_tcp_connect_amavisd_send_port(amavis_t)
+corenet_tcp_connect_smtp_beforequeue_port(amavis_t)
# bind to incoming port
corenet_tcp_bind_amavisd_recv_port(amavis_t)
corenet_udp_bind_generic_port(amavis_t)
--
1.7.0.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100427/c26adb9e/attachment.bin