diff --git a/policy/modules/services/mta.if b/policy/modules/services/mta.if index c527eeed9..5fc01ef4b 100644 --- a/policy/modules/services/mta.if +++ b/policy/modules/services/mta.if @@ -807,6 +807,25 @@ interface(`mta_manage_spool',` manage_lnk_files_pattern($1,mail_spool_t,mail_spool_t) ') +######################################## +## +## Search mail queue dirs. +## +## +## +## Domain allowed access. +## +## +# +interface(`mta_search_queue',` + gen_require(` + type mqueue_spool_t; + ') + + files_search_spool($1) + allow $1 mqueue_spool_t:dir search_dir_perms; +') + ####################################### ## ## Do not audit attempts to read and diff --git a/policy/modules/services/mta.te b/policy/modules/services/mta.te index 2f4d54ca7..23254a397 100644 --- a/policy/modules/services/mta.te +++ b/policy/modules/services/mta.te @@ -1,5 +1,5 @@ -policy_module(mta,1.6.0) +policy_module(mta,1.6.1) ######################################## # diff --git a/policy/modules/services/sendmail.if b/policy/modules/services/sendmail.if index 7c70d808d..300fd3752 100644 --- a/policy/modules/services/sendmail.if +++ b/policy/modules/services/sendmail.if @@ -74,6 +74,26 @@ interface(`sendmail_rw_unix_stream_sockets',` allow $1 sendmail_t:unix_stream_socket { read write }; ') +######################################## +## +## Read sendmail logs. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`sendmail_read_log',` + gen_require(` + type sendmail_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, sendmail_log_t, sendmail_log_t) +') + ######################################## ## ## Create, read, write, and delete sendmail logs. @@ -91,7 +111,7 @@ interface(`sendmail_manage_log',` ') logging_search_logs($1) - allow $1 sendmail_log_t:file manage_file_perms; + manage_files_pattern($1, sendmail_log_t, sendmail_log_t) ') ######################################## diff --git a/policy/modules/services/sendmail.te b/policy/modules/services/sendmail.te index 20be6aeb6..67257c940 100644 --- a/policy/modules/services/sendmail.te +++ b/policy/modules/services/sendmail.te @@ -1,5 +1,5 @@ -policy_module(sendmail,1.4.0) +policy_module(sendmail,1.4.1) ######################################## # diff --git a/policy/modules/services/snmp.te b/policy/modules/services/snmp.te index 8cc09c54b..40ebbd7ae 100644 --- a/policy/modules/services/snmp.te +++ b/policy/modules/services/snmp.te @@ -1,5 +1,5 @@ -policy_module(snmp,1.4.1) +policy_module(snmp,1.4.2) ######################################## # @@ -26,7 +26,7 @@ files_type(snmpd_var_lib_t) # Local policy # allow snmpd_t self:capability { dac_override kill net_admin sys_nice sys_tty_config }; -dontaudit snmpd_t self:capability sys_tty_config; +dontaudit snmpd_t self:capability { sys_module sys_tty_config }; allow snmpd_t self:fifo_file rw_fifo_file_perms; allow snmpd_t self:unix_dgram_socket create_socket_perms; allow snmpd_t self:unix_stream_socket create_stream_socket_perms; @@ -129,26 +129,27 @@ optional_policy(` amanda_dontaudit_read_dumpdates(snmpd_t) ') +optional_policy(` + auth_use_nsswitch(snmpd_t) +') + optional_policy(` cups_read_rw_config(snmpd_t) ') optional_policy(` mta_read_config(snmpd_t) -') - -optional_policy(` - nis_use_ypbind(snmpd_t) -') - -optional_policy(` - nscd_socket_use(snmpd_t) + mta_search_queue(snmpd_t) ') optional_policy(` rpc_search_nfs_state_data(snmpd_t) ') +optional_policy(` + sendmail_read_log(snmpd_t) +') + optional_policy(` seutil_sigchld_newrole(snmpd_t) ')