policy_module(amavis, 1.20.1) ######################################## # # Declarations # ## ##

## Determine whether amavis can ## use JIT compiler. ##

##
gen_tunable(amavis_use_jit, false) type amavis_t; type amavis_exec_t; init_daemon_domain(amavis_t, amavis_exec_t) type amavis_etc_t; files_config_file(amavis_etc_t) type amavis_initrc_exec_t; init_script_file(amavis_initrc_exec_t) type amavis_runtime_t alias amavis_var_run_t; files_runtime_file(amavis_runtime_t) type amavis_var_lib_t; files_type(amavis_var_lib_t) type amavis_var_log_t; logging_log_file(amavis_var_log_t) type amavis_tmp_t; files_tmp_file(amavis_tmp_t) type amavis_quarantine_t; files_type(amavis_quarantine_t) type amavis_spool_t; files_type(amavis_spool_t) ######################################## # # Local policy # allow amavis_t self:capability { chown dac_override kill setgid setuid }; dontaudit amavis_t self:capability sys_tty_config; allow amavis_t self:process signal_perms; allow amavis_t self:fifo_file rw_fifo_file_perms; allow amavis_t self:unix_stream_socket { accept connectto listen }; allow amavis_t self:tcp_socket { listen accept }; allow amavis_t amavis_etc_t:dir list_dir_perms; read_files_pattern(amavis_t, amavis_etc_t, amavis_etc_t) read_lnk_files_pattern(amavis_t, amavis_etc_t, amavis_etc_t) manage_dirs_pattern(amavis_t, amavis_quarantine_t, amavis_quarantine_t) manage_files_pattern(amavis_t, amavis_quarantine_t, amavis_quarantine_t) manage_sock_files_pattern(amavis_t, amavis_quarantine_t, amavis_quarantine_t) manage_dirs_pattern(amavis_t, amavis_spool_t, amavis_spool_t) manage_files_pattern(amavis_t, amavis_spool_t, amavis_spool_t) manage_lnk_files_pattern(amavis_t, amavis_spool_t, amavis_spool_t) manage_sock_files_pattern(amavis_t, amavis_spool_t, amavis_spool_t) filetrans_pattern(amavis_t, amavis_spool_t, amavis_runtime_t, sock_file) manage_files_pattern(amavis_t, amavis_tmp_t, amavis_tmp_t) allow amavis_t amavis_tmp_t:dir setattr_dir_perms; files_tmp_filetrans(amavis_t, amavis_tmp_t, file) manage_dirs_pattern(amavis_t, amavis_var_lib_t, amavis_var_lib_t) manage_files_pattern(amavis_t, amavis_var_lib_t, amavis_var_lib_t) manage_sock_files_pattern(amavis_t, amavis_var_lib_t, amavis_var_lib_t) allow amavis_t amavis_var_log_t:dir setattr_dir_perms; manage_files_pattern(amavis_t, amavis_var_log_t, amavis_var_log_t) manage_sock_files_pattern(amavis_t, amavis_var_log_t, amavis_var_log_t) logging_log_filetrans(amavis_t, amavis_var_log_t, { sock_file file dir }) manage_dirs_pattern(amavis_t, amavis_runtime_t, amavis_runtime_t) manage_files_pattern(amavis_t, amavis_runtime_t, amavis_runtime_t) manage_sock_files_pattern(amavis_t, amavis_runtime_t, amavis_runtime_t) files_runtime_filetrans(amavis_t, amavis_runtime_t, { dir file sock_file }) can_exec(amavis_t, amavis_exec_t) kernel_read_kernel_sysctls(amavis_t) kernel_read_system_state(amavis_t) kernel_dontaudit_list_proc(amavis_t) kernel_dontaudit_read_proc_symlinks(amavis_t) corecmd_exec_bin(amavis_t) corecmd_exec_shell(amavis_t) corenet_all_recvfrom_netlabel(amavis_t) corenet_tcp_sendrecv_generic_if(amavis_t) corenet_udp_sendrecv_generic_if(amavis_t) corenet_tcp_sendrecv_generic_node(amavis_t) corenet_udp_sendrecv_generic_node(amavis_t) corenet_tcp_bind_generic_node(amavis_t) corenet_udp_bind_generic_node(amavis_t) corenet_sendrecv_amavisd_send_client_packets(amavis_t) corenet_tcp_connect_amavisd_send_port(amavis_t) corenet_sendrecv_amavisd_recv_server_packets(amavis_t) corenet_tcp_bind_amavisd_recv_port(amavis_t) corenet_sendrecv_generic_server_packets(amavis_t) corenet_udp_bind_generic_port(amavis_t) corenet_dontaudit_udp_bind_all_ports(amavis_t) corenet_sendrecv_razor_client_packets(amavis_t) corenet_tcp_connect_razor_port(amavis_t) dev_read_rand(amavis_t) dev_read_sysfs(amavis_t) dev_read_urand(amavis_t) domain_use_interactive_fds(amavis_t) domain_dontaudit_read_all_domains_state(amavis_t) files_read_etc_runtime_files(amavis_t) files_read_usr_files(amavis_t) files_search_spool(amavis_t) fs_getattr_xattr_fs(amavis_t) auth_use_nsswitch(amavis_t) auth_dontaudit_read_shadow(amavis_t) init_read_state(amavis_t) init_read_utmp(amavis_t) init_stream_connect_script(amavis_t) logging_send_syslog_msg(amavis_t) miscfiles_read_localization(amavis_t) userdom_dontaudit_search_user_home_dirs(amavis_t) tunable_policy(`amavis_use_jit',` allow amavis_t self:process execmem; ',` dontaudit amavis_t self:process execmem; ') optional_policy(` clamav_scannable_files(amavis_spool_t) clamav_stream_connect(amavis_t) clamav_domtrans_clamscan(amavis_t) clamav_read_state_clamd(amavis_t) ') optional_policy(` cron_use_fds(amavis_t) cron_use_system_job_fds(amavis_t) cron_rw_pipes(amavis_t) ') optional_policy(` dcc_domtrans_client(amavis_t) dcc_stream_connect_dccifd(amavis_t) ') optional_policy(` mta_read_config(amavis_t) ') optional_policy(` postfix_read_config(amavis_t) postfix_list_spool(amavis_t) ') optional_policy(` pyzor_domtrans(amavis_t) pyzor_signal(amavis_t) ') optional_policy(` razor_domtrans(amavis_t) ') optional_policy(` snmp_manage_var_lib_dirs(amavis_t) snmp_manage_var_lib_files(amavis_t) snmp_stream_connect(amavis_t) ') optional_policy(` spamassassin_exec(amavis_t) spamassassin_exec_client(amavis_t) spamassassin_read_lib_files(amavis_t) ')