forked from pool/selinux-policy
b66c2b8ce6
- Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus OBS-URL: https://build.opensuse.org/request/show/1035580 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=155
121 lines
6.9 KiB
Diff
121 lines
6.9 KiB
Diff
Index: fedora-policy-20221019/policy/modules/contrib/postfix.fc
|
|
===================================================================
|
|
--- fedora-policy-20221019.orig/policy/modules/contrib/postfix.fc
|
|
+++ fedora-policy-20221019/policy/modules/contrib/postfix.fc
|
|
@@ -1,37 +1,21 @@
|
|
# postfix
|
|
-/etc/rc\.d/init\.d/postfix -- gen_context(system_u:object_r:postfix_initrc_exec_t,s0)
|
|
-/etc/postfix.* gen_context(system_u:object_r:postfix_etc_t,s0)
|
|
-/etc/postfix/chroot-update -- gen_context(system_u:object_r:postfix_exec_t,s0)
|
|
-ifdef(`distro_redhat', `
|
|
-/usr/libexec/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
|
|
-/usr/libexec/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0)
|
|
-/usr/libexec/postfix/lmtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
|
|
-/usr/libexec/postfix/local -- gen_context(system_u:object_r:postfix_local_exec_t,s0)
|
|
-/usr/libexec/postfix/master -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
|
|
-/usr/libexec/postfix/pickup -- gen_context(system_u:object_r:postfix_pickup_exec_t,s0)
|
|
-/usr/libexec/postfix/(n)?qmgr -- gen_context(system_u:object_r:postfix_qmgr_exec_t,s0)
|
|
-/usr/libexec/postfix/showq -- gen_context(system_u:object_r:postfix_showq_exec_t,s0)
|
|
-/usr/libexec/postfix/smtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
|
|
-/usr/libexec/postfix/scache -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
|
|
-/usr/libexec/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0)
|
|
-/usr/libexec/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0)
|
|
-/usr/libexec/postfix/pipe -- gen_context(system_u:object_r:postfix_pipe_exec_t,s0)
|
|
-/usr/libexec/postfix/virtual -- gen_context(system_u:object_r:postfix_virtual_exec_t,s0)
|
|
-', `
|
|
-/usr/lib/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
|
|
-/usr/lib/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0)
|
|
-/usr/lib/postfix/local -- gen_context(system_u:object_r:postfix_local_exec_t,s0)
|
|
-/usr/lib/postfix/master -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
|
|
-/usr/lib/postfix/pickup -- gen_context(system_u:object_r:postfix_pickup_exec_t,s0)
|
|
-/usr/lib/postfix/(n)?qmgr -- gen_context(system_u:object_r:postfix_qmgr_exec_t,s0)
|
|
-/usr/lib/postfix/showq -- gen_context(system_u:object_r:postfix_showq_exec_t,s0)
|
|
-/usr/lib/postfix/smtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
|
|
-/usr/lib/postfix/lmtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
|
|
-/usr/lib/postfix/scache -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
|
|
-/usr/lib/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0)
|
|
-/usr/lib/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0)
|
|
-/usr/lib/postfix/pipe -- gen_context(system_u:object_r:postfix_pipe_exec_t,s0)
|
|
-')
|
|
+/etc/rc\.d/init\.d/postfix -- gen_context(system_u:object_r:postfix_initrc_exec_t,s0)
|
|
+/etc/postfix.* gen_context(system_u:object_r:postfix_etc_t,s0)
|
|
+/etc/postfix/chroot-update -- gen_context(system_u:object_r:postfix_exec_t,s0)
|
|
+/usr/lib/postfix/bin/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
|
|
+/usr/lib/postfix/systemd/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
|
|
+/usr/lib/postfix/bin/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0)
|
|
+/usr/lib/postfix/bin/local -- gen_context(system_u:object_r:postfix_local_exec_t,s0)
|
|
+/usr/lib/postfix/bin/master -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
|
|
+/usr/lib/postfix/bin/pickup -- gen_context(system_u:object_r:postfix_pickup_exec_t,s0)
|
|
+/usr/lib/postfix/bin/(n)?qmgr -- gen_context(system_u:object_r:postfix_qmgr_exec_t,s0)
|
|
+/usr/lib/postfix/bin/showq -- gen_context(system_u:object_r:postfix_showq_exec_t,s0)
|
|
+/usr/lib/postfix/bin/smtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
|
|
+/usr/lib/postfix/bin/lmtp -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
|
|
+/usr/lib/postfix/bin/scache -- gen_context(system_u:object_r:postfix_smtp_exec_t,s0)
|
|
+/usr/lib/postfix/bin/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0)
|
|
+/usr/lib/postfix/bin/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0)
|
|
+/usr/lib/postfix/bin/pipe -- gen_context(system_u:object_r:postfix_pipe_exec_t,s0)
|
|
/etc/postfix/postfix-script.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
|
|
/etc/postfix/prng_exch -- gen_context(system_u:object_r:postfix_prng_t,s0)
|
|
/usr/sbin/postalias -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
|
|
@@ -45,13 +29,16 @@ ifdef(`distro_redhat', `
|
|
/usr/sbin/postqueue -- gen_context(system_u:object_r:postfix_postqueue_exec_t,s0)
|
|
/usr/sbin/postsuper -- gen_context(system_u:object_r:postfix_master_exec_t,s0)
|
|
|
|
+/etc/postfix/system/.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
|
|
+/etc/postfix/system/update_postmaps -- gen_context(system_u:object_r:postfix_map_exec_t,s0)
|
|
+
|
|
/var/lib/postfix.* gen_context(system_u:object_r:postfix_data_t,s0)
|
|
|
|
/var/spool/postfix.* gen_context(system_u:object_r:postfix_spool_t,s0)
|
|
/var/spool/postfix/deferred(/.*)? gen_context(system_u:object_r:postfix_spool_t,s0)
|
|
/var/spool/postfix/defer(/.*)? gen_context(system_u:object_r:postfix_spool_t,s0)
|
|
/var/spool/postfix/maildrop(/.*)? gen_context(system_u:object_r:postfix_spool_t,s0)
|
|
-/var/spool/postfix/pid/.* gen_context(system_u:object_r:postfix_var_run_t,s0)
|
|
+/var/spool/postfix/pid(/.*)? gen_context(system_u:object_r:postfix_var_run_t,s0)
|
|
/var/spool/postfix/private(/.*)? gen_context(system_u:object_r:postfix_private_t,s0)
|
|
/var/spool/postfix/public(/.*)? gen_context(system_u:object_r:postfix_public_t,s0)
|
|
/var/spool/postfix/bounce(/.*)? gen_context(system_u:object_r:postfix_spool_bounce_t,s0)
|
|
Index: fedora-policy-20221019/policy/modules/contrib/postfix.te
|
|
===================================================================
|
|
--- fedora-policy-20221019.orig/policy/modules/contrib/postfix.te
|
|
+++ fedora-policy-20221019/policy/modules/contrib/postfix.te
|
|
@@ -121,6 +121,8 @@ allow postfix_master_t self:udp_socket c
|
|
allow postfix_master_t postfix_etc_t:dir rw_dir_perms;
|
|
allow postfix_master_t postfix_etc_t:file rw_file_perms;
|
|
mta_filetrans_aliases(postfix_master_t, postfix_etc_t)
|
|
+# SUSE also runs this on /etc/alias
|
|
+mta_filetrans_aliases(postfix_master_t, etc_t)
|
|
|
|
can_exec(postfix_master_t, postfix_exec_t)
|
|
|
|
@@ -447,6 +449,14 @@ logging_send_syslog_msg(postfix_map_t)
|
|
|
|
userdom_use_inherited_user_ptys(postfix_map_t)
|
|
|
|
+corecmd_exec_bin(postfix_map_t)
|
|
+allow postfix_map_t postfix_map_exec_t:file execute_no_trans;
|
|
+init_ioctl_stream_sockets(postfix_map_t)
|
|
+
|
|
+optional_policy(`
|
|
+ mta_read_aliases(postfix_map_t)
|
|
+')
|
|
+
|
|
optional_policy(`
|
|
locallogin_dontaudit_use_fds(postfix_map_t)
|
|
')
|
|
@@ -687,6 +697,14 @@ corenet_tcp_connect_spamd_port(postfix_m
|
|
files_search_all_mountpoints(postfix_smtp_t)
|
|
|
|
optional_policy(`
|
|
+ networkmanager_read_pid_files(postfix_smtp_t)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ wicked_read_pid_files(postfix_smtp_t)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
cyrus_stream_connect(postfix_smtp_t)
|
|
cyrus_runtime_stream_connect(postfix_smtp_t)
|
|
')
|