[selinux-policy: 2464/3172] Various amavis fixes.
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 22:38:45 UTC 2010
commit 88340b904ae88118c8bf8c823724482f18921931
Author: Dominick Grift <domg472 at gmail.com>
Date: Wed Feb 24 13:00:42 2010 +0100
Various amavis fixes.
Create amavis_initrc_domtrans.
Call amavis_initrc_domtrans from amavis_admin.
Remove obsolete require.
Allow domains to search bin to enable run amavis executable.
Signed-off-by: Dominick Grift <domg472 at gmail.com>
policy/modules/services/amavis.if | 22 ++++++++++++++++++++--
1 files changed, 20 insertions(+), 2 deletions(-)
---
diff --git a/policy/modules/services/amavis.if b/policy/modules/services/amavis.if
index db18f31..22523cd 100644
--- a/policy/modules/services/amavis.if
+++ b/policy/modules/services/amavis.if
@@ -18,11 +18,30 @@ interface(`amavis_domtrans',`
type amavis_t, amavis_exec_t;
')
+ corecmd_search_bin($1)
domtrans_pattern($1, amavis_exec_t, amavis_t)
')
########################################
## <summary>
+## Execute amavis server in the amavis domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## The type of the process performing this action.
+## </summary>
+## </param>
+#
+interface(`amavis_initrc_domtrans',`
+ gen_require(`
+ type afs_initrc_exec_t;
+ ')
+
+ init_labeled_script_domtrans($1, amavis_initrc_exec_t)
+')
+
+########################################
+## <summary>
## Read amavis spool files.
## </summary>
## <param name="domain">
@@ -209,13 +228,12 @@ interface(`amavis_admin',`
type amavis_t, amavis_tmp_t, amavis_var_log_t;
type amavis_spool_t, amavis_var_lib_t, amavis_var_run_t;
type amavis_etc_t, amavis_quarantine_t;
- type amavis_initrc_exec_t;
')
allow $1 amavis_t:process { ptrace signal_perms };
ps_process_pattern($1, amavis_t)
- init_labeled_script_domtrans($1, amavis_initrc_exec_t)
+ amavis_initrc_domtrans($1)
domain_system_change_exemption($1)
role_transition $2 amavis_initrc_exec_t system_r;
allow $2 system_r;
More information about the scm-commits
mailing list