From: domg472@gmail.com (Dominick Grift) Date: Tue, 27 Apr 2010 13:54:46 +0200 Subject: [refpolicy] [ Implement ClamSMTPd policy. 2/5] Allow amavis_t to tcp connect to smtp_beforequeue_port_t. Message-ID: <20100427115443.GA32736@localhost.localdomain> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com Allow amavis_t to tcp connect to smtp_beforequeue_port_t and allow amavis_t to send and receive smtp_beforequeue client packets. Remove redundant policy that allows amavis to tcp send and receive to and from amavis send and recv ports. Amavis already is allowed to tcp send and receive to and from all ports. Remove policy that allows amavis_t to tcp connect to amavisd_send_port_t since it was replaced by smtp_beforequeue_port_t. Signed-off-by: Dominick Grift --- :100644 100644 ee09816... 0d0e3da... M policy/modules/services/amavis.te policy/modules/services/amavis.te | 7 ++----- 1 files changed, 2 insertions(+), 5 deletions(-) diff --git a/policy/modules/services/amavis.te b/policy/modules/services/amavis.te index ee09816..0d0e3da 100644 --- a/policy/modules/services/amavis.te +++ b/policy/modules/services/amavis.te @@ -108,17 +108,14 @@ corecmd_exec_bin(amavis_t) corenet_all_recvfrom_unlabeled(amavis_t) corenet_all_recvfrom_netlabel(amavis_t) +corenet_sendrecv_smtp_beforequeue_client_packets(amavis_t) corenet_tcp_sendrecv_generic_if(amavis_t) corenet_tcp_sendrecv_generic_node(amavis_t) corenet_tcp_bind_generic_node(amavis_t) corenet_udp_bind_generic_node(amavis_t) -# amavis uses well-defined ports -corenet_tcp_sendrecv_amavisd_recv_port(amavis_t) -corenet_tcp_sendrecv_amavisd_send_port(amavis_t) -# just the other side not. ;-) corenet_tcp_sendrecv_all_ports(amavis_t) # connect to backchannel port -corenet_tcp_connect_amavisd_send_port(amavis_t) +corenet_tcp_connect_smtp_beforequeue_port(amavis_t) # bind to incoming port corenet_tcp_bind_amavisd_recv_port(amavis_t) corenet_udp_bind_generic_port(amavis_t) -- 1.7.0.1 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100427/c26adb9e/attachment.bin