From: cpebenito@tresys.com (Christopher J. PeBenito) Date: Wed, 23 Mar 2011 08:56:28 -0400 Subject: [refpolicy] [PATCH 12/15] postalias command should stay bin_t In-Reply-To: <20110309212413.GA7554@siphos.be> References: <20110309212413.GA7554@siphos.be> Message-ID: <4D89EDFC.7040902@tresys.com> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com On 03/09/11 16:24, Sven Vermeulen wrote: > postalias should stay bin_t, is manually executed (no role executes > postfix_master_exec_t as it is only to be launched through init scripts). > > The postalias command is used to regenerate the aliases.db file from the > mail aliases and as such is a system administrative activity. However, by > default, no role has execute rights on any postfix_master_exec_t domains as > the domain is apparently meant only to be started from the run_init_t > domain. Merged. > Signed-off-by: Sven Vermeulen > --- > policy/modules/services/postfix.fc | 1 - > 1 files changed, 0 insertions(+), 1 deletions(-) > > diff --git a/policy/modules/services/postfix.fc b/policy/modules/services/postfix.fc > index 958e241..4ceab5d 100644 > --- a/policy/modules/services/postfix.fc > +++ b/policy/modules/services/postfix.fc > @@ -32,7 +32,6 @@ ifdef(`distro_redhat', ` > ') > /etc/postfix/postfix-script.* -- gen_context(system_u:object_r:postfix_exec_t,s0) > /etc/postfix/prng_exch -- gen_context(system_u:object_r:postfix_prng_t,s0) > -/usr/sbin/postalias -- gen_context(system_u:object_r:postfix_master_exec_t,s0) > /usr/sbin/postcat -- gen_context(system_u:object_r:postfix_master_exec_t,s0) > /usr/sbin/postdrop -- gen_context(system_u:object_r:postfix_postdrop_exec_t,s0) > /usr/sbin/postfix -- gen_context(system_u:object_r:postfix_master_exec_t,s0) -- Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com