From: sven.vermeulen@siphos.be (Sven Vermeulen) Date: Wed, 9 Mar 2011 22:24:15 +0100 Subject: [refpolicy] [PATCH 12/15] postalias command should stay bin_t Message-ID: <20110309212413.GA7554@siphos.be> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com postalias should stay bin_t, is manually executed (no role executes postfix_master_exec_t as it is only to be launched through init scripts). The postalias command is used to regenerate the aliases.db file from the mail aliases and as such is a system administrative activity. However, by default, no role has execute rights on any postfix_master_exec_t domains as the domain is apparently meant only to be started from the run_init_t domain. Signed-off-by: Sven Vermeulen --- policy/modules/services/postfix.fc | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) diff --git a/policy/modules/services/postfix.fc b/policy/modules/services/postfix.fc index 958e241..4ceab5d 100644 --- a/policy/modules/services/postfix.fc +++ b/policy/modules/services/postfix.fc @@ -32,7 +32,6 @@ ifdef(`distro_redhat', ` ') /etc/postfix/postfix-script.* -- gen_context(system_u:object_r:postfix_exec_t,s0) /etc/postfix/prng_exch -- gen_context(system_u:object_r:postfix_prng_t,s0) -/usr/sbin/postalias -- gen_context(system_u:object_r:postfix_master_exec_t,s0) /usr/sbin/postcat -- gen_context(system_u:object_r:postfix_master_exec_t,s0) /usr/sbin/postdrop -- gen_context(system_u:object_r:postfix_postdrop_exec_t,s0) /usr/sbin/postfix -- gen_context(system_u:object_r:postfix_master_exec_t,s0) -- 1.7.3.4