123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408 |
- ## <summary>Filter used for removing unsolicited email.</summary>
- ########################################
- ## <summary>
- ## Role access for spamassassin.
- ## </summary>
- ## <param name="role">
- ## <summary>
- ## Role allowed access.
- ## </summary>
- ## </param>
- ## <param name="domain">
- ## <summary>
- ## User domain for the role.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_role',`
- gen_require(`
- type spamc_t, spamc_exec_t, spamc_tmp_t;
- type spamassassin_t, spamassassin_exec_t, spamd_home_t;
- type spamassassin_home_t, spamassassin_tmp_t;
- ')
- role $1 types { spamc_t spamassassin_t };
- domtrans_pattern($2, spamassassin_exec_t, spamassassin_t)
- domtrans_pattern($2, spamc_exec_t, spamc_t)
- allow $2 { spamc_t spamassassin_t}:process { ptrace signal_perms };
- ps_process_pattern($2, { spamc_t spamassassin_t })
- allow $2 { spamc_tmp_t spamd_home_t spamassassin_home_t spamassassin_tmp_t }:dir { manage_dir_perms relabel_dir_perms };
- allow $2 { spamc_tmp_t spamd_home_t spamassassin_home_t spamassassin_tmp_t }:file { manage_file_perms relabel_file_perms };
- allow $2 { spamc_tmp_t spamd_home_t spamassassin_home_t spamassassin_tmp_t }:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
- userdom_user_home_dir_filetrans($2, spamassassin_home_t, dir, ".spamassassin")
- userdom_user_home_dir_filetrans($2, spamd_home_t, dir, ".spamd")
- ')
- ########################################
- ## <summary>
- ## Execute the standalone spamassassin
- ## program in the caller directory.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_exec',`
- gen_require(`
- type spamassassin_exec_t;
- ')
- corecmd_search_bin($1)
- can_exec($1, spamassassin_exec_t)
- ')
- ########################################
- ## <summary>
- ## Send generic signals to spamd.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_signal_spamd',`
- gen_require(`
- type spamd_t;
- ')
- allow $1 spamd_t:process signal;
- ')
- ########################################
- ## <summary>
- ## Execute spamd in the caller domain.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_exec_spamd',`
- gen_require(`
- type spamd_exec_t;
- ')
- corecmd_search_bin($1)
- can_exec($1, spamd_exec_t)
- ')
- ########################################
- ## <summary>
- ## Execute spamc in the spamc domain.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed to transition.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_domtrans_client',`
- gen_require(`
- type spamc_t, spamc_exec_t;
- ')
- corecmd_search_bin($1)
- domtrans_pattern($1, spamc_exec_t, spamc_t)
- ')
- ########################################
- ## <summary>
- ## Execute spamc in the caller domain.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_exec_client',`
- gen_require(`
- type spamc_exec_t;
- ')
- corecmd_search_bin($1)
- can_exec($1, spamc_exec_t)
- ')
- ########################################
- ## <summary>
- ## Send kill signals to spamc.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_kill_client',`
- gen_require(`
- type spamc_t;
- ')
- allow $1 spamc_t:process sigkill;
- ')
- ########################################
- ## <summary>
- ## Execute spamassassin standalone client
- ## in the user spamassassin domain.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed to transition.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_domtrans_local_client',`
- gen_require(`
- type spamassassin_t, spamassassin_exec_t;
- ')
- corecmd_search_bin($1)
- domtrans_pattern($1, spamassassin_exec_t, spamassassin_t)
- ')
- ########################################
- ## <summary>
- ## Create, read, write, and delete
- ## spamd home content.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_manage_spamd_home_content',`
- gen_require(`
- type spamd_home_t;
- ')
- userdom_search_user_home_dirs($1)
- allow $1 spamd_home_t:dir manage_dir_perms;
- allow $1 spamd_home_t:file manage_file_perms;
- allow $1 spamd_home_t:lnk_file manage_lnk_file_perms;
- ')
- ########################################
- ## <summary>
- ## Relabel spamd home content.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_relabel_spamd_home_content',`
- gen_require(`
- type spamd_home_t;
- ')
- userdom_search_user_home_dirs($1)
- allow $1 spamd_home_t:dir relabel_dir_perms;
- allow $1 spamd_home_t:file relabel_file_perms;
- allow $1 spamd_home_t:lnk_file relabel_lnk_file_perms;
- ')
- ########################################
- ## <summary>
- ## Create objects in user home
- ## directories with the spamd home type.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- ## <param name="object_class">
- ## <summary>
- ## Class of the object being created.
- ## </summary>
- ## </param>
- ## <param name="name" optional="true">
- ## <summary>
- ## The name of the object being created.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_home_filetrans_spamd_home',`
- gen_require(`
- type spamd_home_t;
- ')
- userdom_user_home_dir_filetrans($1, spamd_home_t, $2, $3)
- ')
- ########################################
- ## <summary>
- ## Read spamd lib files.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_read_lib_files',`
- gen_require(`
- type spamd_var_lib_t;
- ')
- files_search_var_lib($1)
- read_files_pattern($1, spamd_var_lib_t, spamd_var_lib_t)
- ')
- ########################################
- ## <summary>
- ## Create, read, write, and delete
- ## spamd lib files.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_manage_lib_files',`
- gen_require(`
- type spamd_var_lib_t;
- ')
- files_search_var_lib($1)
- manage_files_pattern($1, spamd_var_lib_t, spamd_var_lib_t)
- ')
- ########################################
- ## <summary>
- ## Read spamd pid files.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_read_spamd_pid_files',`
- gen_require(`
- type spamd_var_run_t;
- ')
- files_search_pids($1)
- read_files_pattern($1, spamd_var_run_t, spamd_var_run_t)
- ')
- ########################################
- ## <summary>
- ## Read temporary spamd files.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_read_spamd_tmp_files',`
- gen_require(`
- type spamd_tmp_t;
- ')
- allow $1 spamd_tmp_t:file read_file_perms;
- ')
- ########################################
- ## <summary>
- ## Do not audit attempts to get
- ## attributes of temporary spamd sockets.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain to not audit.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_dontaudit_getattr_spamd_tmp_sockets',`
- gen_require(`
- type spamd_tmp_t;
- ')
- dontaudit $1 spamd_tmp_t:sock_file getattr;
- ')
- ########################################
- ## <summary>
- ## Connect to spamd with a unix
- ## domain stream socket.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- #
- interface(`spamassassin_stream_connect_spamd',`
- gen_require(`
- type spamd_t, spamd_var_run_t;
- ')
- files_search_pids($1)
- stream_connect_pattern($1, spamd_var_run_t, spamd_var_run_t, spamd_t)
- ')
- ########################################
- ## <summary>
- ## All of the rules required to
- ## administrate an spamassassin environment.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
- ## <param name="role">
- ## <summary>
- ## Role allowed access.
- ## </summary>
- ## </param>
- ## <rolecap/>
- #
- interface(`spamassassin_admin',`
- gen_require(`
- type spamd_t, spamd_tmp_t, spamd_log_t;
- type spamd_spool_t, spamd_var_lib_t, spamd_var_run_t;
- type spamd_initrc_exec_t;
- ')
- allow $1 spamd_t:process { ptrace signal_perms };
- ps_process_pattern($1, spamd_t)
- init_labeled_script_domtrans($1, spamd_initrc_exec_t)
- domain_system_change_exemption($1)
- role_transition $2 spamd_initrc_exec_t system_r;
- allow $2 system_r;
- files_list_tmp($1)
- admin_pattern($1, spamd_tmp_t)
- logging_list_logs($1)
- admin_pattern($1, spamd_log_t)
- files_list_spool($1)
- admin_pattern($1, spamd_spool_t)
- files_list_var_lib($1)
- admin_pattern($1, spamd_var_lib_t)
- files_list_pids($1)
- admin_pattern($1, spamd_var_run_t)
- spamassassin_role($2, $1)
- ')
|