postalias should stay bin_t, is manually executed (no role executes
postfix_master_exec_t as it is only to be launched through init scripts).
The postalias command is used to regenerate the aliases.db file from the
mail aliases and as such is a system administrative activity. However, by
default, no role has execute rights on any postfix_master_exec_t domains as
the domain is apparently meant only to be started from the run_init_t
domain.
Signed-off-by: Sven Vermeulen <[email protected]>
---
policy/modules/services/postfix.fc | 1 -
1 files changed, 0 insertions(+), 1 deletions(-)
diff --git a/policy/modules/services/postfix.fc b/policy/modules/services/postfix.fc
index 958e241..4ceab5d 100644
--- a/policy/modules/services/postfix.fc
+++ b/policy/modules/services/postfix.fc
@@ -32,7 +32,6 @@ ifdef(`distro_redhat', `
')
/etc/postfix/postfix-script.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
/etc/postfix/prng_exch -- gen_context(system_u:object_r:postfix_prng_t,s0)
-/usr/sbin/postalias -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
/usr/sbin/postcat -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
/usr/sbin/postdrop -- gen_context(system_u:object_r:postfix_postdrop_exec_t,s0)
/usr/sbin/postfix -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
--
1.7.3.4
On 03/09/11 16:24, Sven Vermeulen wrote:
> postalias should stay bin_t, is manually executed (no role executes
> postfix_master_exec_t as it is only to be launched through init scripts).
>
> The postalias command is used to regenerate the aliases.db file from the
> mail aliases and as such is a system administrative activity. However, by
> default, no role has execute rights on any postfix_master_exec_t domains as
> the domain is apparently meant only to be started from the run_init_t
> domain.
Merged.
> Signed-off-by: Sven Vermeulen <[email protected]>
> ---
> policy/modules/services/postfix.fc | 1 -
> 1 files changed, 0 insertions(+), 1 deletions(-)
>
> diff --git a/policy/modules/services/postfix.fc b/policy/modules/services/postfix.fc
> index 958e241..4ceab5d 100644
> --- a/policy/modules/services/postfix.fc
> +++ b/policy/modules/services/postfix.fc
> @@ -32,7 +32,6 @@ ifdef(`distro_redhat', `
> ')
> /etc/postfix/postfix-script.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
> /etc/postfix/prng_exch -- gen_context(system_u:object_r:postfix_prng_t,s0)
> -/usr/sbin/postalias -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
> /usr/sbin/postcat -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
> /usr/sbin/postdrop -- gen_context(system_u:object_r:postfix_postdrop_exec_t,s0)
> /usr/sbin/postfix -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com