[selinux-policy: 2363/3172] MTA patch from Dan Walsh.

[Daniel J Walsh]

commit 9c40673ff5962ea9237527cb83d5e85297c6697f
Author: Chris PeBenito <cpebenito at tresys.com>
Date:   Thu Jan 7 09:48:35 2010 -0500

    MTA patch from Dan Walsh.

 policy/modules/services/mta.fc |    6 ++++--
 policy/modules/services/mta.if |   10 +++++++---
 policy/modules/services/mta.te |   30 +++++++++++++++++++++++++++++-
 3 files changed, 40 insertions(+), 6 deletions(-)
---
diff --git a/policy/modules/services/mta.fc b/policy/modules/services/mta.fc
index 5193fc3..256166a 100644
--- a/policy/modules/services/mta.fc
+++ b/policy/modules/services/mta.fc
@@ -1,15 +1,17 @@
+HOME_DIR/\.forward	--	gen_context(system_u:object_r:mail_forward_t,s0)
+
 /bin/mail(x)?		--	gen_context(system_u:object_r:sendmail_exec_t,s0)
 
 /etc/aliases		--	gen_context(system_u:object_r:etc_aliases_t,s0)
 /etc/aliases\.db	--	gen_context(system_u:object_r:etc_aliases_t,s0)
 /etc/mail(/.*)?			gen_context(system_u:object_r:etc_mail_t,s0)
 /etc/mail/aliases	--	gen_context(system_u:object_r:etc_aliases_t,s0)
-/etc/mail/aliases\.db	--	gen_context(system_u:object_r:etc_aliases_t,s0) 
+/etc/mail/aliases\.db	--	gen_context(system_u:object_r:etc_aliases_t,s0)
 ifdef(`distro_redhat',`
 /etc/postfix/aliases.*		gen_context(system_u:object_r:etc_aliases_t,s0)
 ')
 
-/usr/bin/esmtp    		-- gen_context(system_u:object_r:sendmail_exec_t,s0)
+/usr/bin/esmtp			-- gen_context(system_u:object_r:sendmail_exec_t,s0)
 
 /usr/lib(64)?/sendmail	--	gen_context(system_u:object_r:sendmail_exec_t,s0)
 /usr/lib/courier/bin/sendmail	--	gen_context(system_u:object_r:sendmail_exec_t,s0)
diff --git a/policy/modules/services/mta.if b/policy/modules/services/mta.if
index 9b9dd2d..0c73e52 100644
--- a/policy/modules/services/mta.if
+++ b/policy/modules/services/mta.if
@@ -69,6 +69,7 @@ template(`mta_base_mail_template',`
 	can_exec($1_mail_t, sendmail_exec_t)
 	allow $1_mail_t sendmail_exec_t:lnk_file read_lnk_file_perms;
 
+	kernel_read_system_state($1_mail_t)
 	kernel_read_kernel_sysctls($1_mail_t)
 
 	corenet_all_recvfrom_unlabeled($1_mail_t)
@@ -89,6 +90,8 @@ template(`mta_base_mail_template',`
 
 	auth_use_nsswitch($1_mail_t)
 
+	init_dontaudit_rw_utmp($1_mail_t)
+
 	logging_send_syslog_msg($1_mail_t)
 
 	miscfiles_read_localization($1_mail_t)
@@ -193,7 +196,7 @@ interface(`mta_mailserver',`
 		attribute mailserver_domain;
 	')
 
-	init_daemon_domain($1,$2)
+	init_daemon_domain($1, $2)
 	typeattribute $1 mailserver_domain;
 ')
 
@@ -311,6 +314,7 @@ interface(`mta_mailserver_delivery',`
 	allow $1 mail_spool_t:dir list_dir_perms;
 	create_files_pattern($1, mail_spool_t, mail_spool_t)
 	read_files_pattern($1, mail_spool_t, mail_spool_t)
+	append_files_pattern($1, mail_spool_t, mail_spool_t)
 	create_lnk_files_pattern($1, mail_spool_t, mail_spool_t)
 	read_lnk_files_pattern($1, mail_spool_t, mail_spool_t)
 
@@ -376,7 +380,7 @@ interface(`mta_send_mail',`
 
 	allow mta_user_agent $1:fd use;
 	allow mta_user_agent $1:process sigchld;
-	allow mta_user_agent $1:fifo_file { read write };
+	allow mta_user_agent $1:fifo_file rw_fifo_file_perms;
 ')
 
 ########################################
@@ -648,7 +652,7 @@ interface(`mta_dontaudit_getattr_spool_files',`
 
 #######################################
 ## <summary>
-##	Create private objects in the 
+##	Create private objects in the
 ##	mail spool directory.
 ## </summary>
 ## <param name="domain">
diff --git a/policy/modules/services/mta.te b/policy/modules/services/mta.te
index 82eaf44..da4022a 100644
--- a/policy/modules/services/mta.te
+++ b/policy/modules/services/mta.te
@@ -1,5 +1,5 @@
 
-policy_module(mta, 2.2.0)
+policy_module(mta, 2.2.1)
 
 ########################################
 #
@@ -21,6 +21,9 @@ files_type(etc_aliases_t)
 type etc_mail_t;
 files_config_file(etc_mail_t)
 
+type mail_forward_t;
+files_type(mail_forward_t)
+
 type mqueue_spool_t;
 files_mountpoint(mqueue_spool_t)
 
@@ -51,14 +54,18 @@ allow system_mail_t self:capability { dac_override fowner };
 allow system_mail_t self:fifo_file rw_fifo_file_perms;
 
 read_files_pattern(system_mail_t, etc_mail_t, etc_mail_t)
+
 read_files_pattern(system_mail_t, mailcontent_type, mailcontent_type)
 
+allow system_mail_t mail_forward_t:file read_file_perms;
+
 allow system_mail_t mta_exec_type:file entrypoint;
 
 can_exec(system_mail_t, mta_exec_type)
 
 kernel_read_system_state(system_mail_t)
 kernel_read_network_state(system_mail_t)
+kernel_request_load_module(system_mail_t)
 
 dev_read_sysfs(system_mail_t)
 dev_read_rand(system_mail_t)
@@ -199,6 +206,27 @@ optional_policy(`
 
 ########################################
 #
+# Mailserver delivery local policy
+#
+
+read_files_pattern(mailserver_delivery, mail_forward_t, mail_forward_t)
+
+read_files_pattern(mailserver_delivery, system_mail_tmp_t, system_mail_tmp_t)
+
+tunable_policy(`use_samba_home_dirs',`
+	fs_manage_cifs_dirs(mailserver_delivery)
+	fs_manage_cifs_files(mailserver_delivery)
+	fs_manage_cifs_symlinks(mailserver_delivery)
+')
+
+tunable_policy(`use_nfs_home_dirs',`
+	fs_manage_nfs_dirs(mailserver_delivery)
+	fs_manage_nfs_files(mailserver_delivery)
+	fs_manage_nfs_symlinks(mailserver_delivery)
+')
+
+########################################
+#
 # User send mail local policy
 #