Changeset 81 for selinux/build/misc.te

Timestamp:

Jan 19, 2007, 7:44:57 AM (17 years ago)

Author:

presbrey

Message:

more specific SELinux AFS access interface
procmail can spawn system binaries

File:

• selinux/build/misc.te (modified) (4 diffs)

selinux/build/misc.te

@@ -5 +5 @@
 require {
         type crond_t, kernel_t, sshd_t, user_t, httpd_t;
+        type postfix_local_t, procmail_t;
         type proc_t;
 }
@@ -11 +12 @@
 afs_access(httpd_t);
 afs_access(kernel_t);
+afs_access(postfix_local_t);
+afs_access(procmail_t);
 afs_access(sshd_t);
 afs_access(user_t);
@@ -43 +46 @@
 
 require {
-        type sshd_t;
+        type sendmail_t, sshd_t;
 };
 
@@ -53 +56 @@
 mta_sendmail_exec(user_t)
 can_exec(user_t, sendmail_exec_t)
-
+allow sendmail_t postfix_local_t:fd use;
+allow sendmail_t postfix_local_t:fifo_file { getattr write };
+corecmd_exec_bin(procmail_t)
+corecmd_exec_sbin(procmail_t)
 
 ### HTTPD ###