#
# Macros for sendmail domains.
#

#
# Authors:  Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser 
#           Russell Coker <russell@coker.com.au>
#

#
# sendmail_user_domain(domain_prefix)
#
# Define a derived domain for the sendmail program when executed by
# a user domain to send outgoing mail.  These domains are separate and
# independent of the domain used for the sendmail daemon process.
#
undefine(`sendmail_user_domain')
define(`sendmail_user_domain', `

# Use capabilities
allow $1_mail_t self:capability net_bind_service;

tmp_domain($1_mail)

# Write to /var/spool/mail and /var/spool/mqueue.
allow $1_mail_t mail_spool_t:dir rw_dir_perms;
allow $1_mail_t mail_spool_t:file create_file_perms;
allow $1_mail_t mqueue_spool_t:dir rw_dir_perms;
allow $1_mail_t mqueue_spool_t:file create_file_perms;

# Write to /var/log/sendmail.st
file_type_auto_trans($1_mail_t, var_log_t, sendmail_log_t)

allow $1_mail_t etc_mail_t:dir { getattr search };

allow $1_mail_t { var_t var_spool_t }:dir getattr;

allow $1_mail_t etc_runtime_t:file { getattr read };

# Check available space.
allow $1_mail_t fs_t:filesystem getattr;

allow $1_mail_t sysctl_kernel_t:dir search;

ifelse(`$1', `sysadm', `
allow $1_mail_t proc_t:dir { getattr search };
allow $1_mail_t proc_t:{ lnk_file file } { getattr read };
dontaudit $1_mail_t proc_net_t:dir search;
allow $1_mail_t sysctl_kernel_t:file { getattr read };
allow $1_mail_t etc_runtime_t:file { getattr read };
', `
dontaudit $1_mail_t proc_t:dir search;
dontaudit $1_mail_t sysctl_kernel_t:file read;
')dnl end if sysadm
')