From 871f0b0dd7034a30fc0f97ab0d3ead098c2a1320 Mon Sep 17 00:00:00 2001
From: Kenton Groombridge <concord@gentoo.org>
Date: Wed, 15 May 2024 11:07:42 -0400
Subject: [PATCH] postfix: allow smtpd to mmap SASL keytab files

Signed-off-by: Kenton Groombridge <concord@gentoo.org>
---
 policy/modules/services/postfix.te |  2 +-
 policy/modules/services/sasl.if    | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/policy/modules/services/postfix.te b/policy/modules/services/postfix.te
index f85c82754..60a2fd054 100644
--- a/policy/modules/services/postfix.te
+++ b/policy/modules/services/postfix.te
@@ -844,7 +844,7 @@ optional_policy(`
 
 optional_policy(`
 	sasl_connect(postfix_smtpd_t)
-	sasl_read_keytab(postfix_smtpd_t)
+	sasl_mmap_read_keytab(postfix_smtpd_t)
 ')
 
 optional_policy(`
diff --git a/policy/modules/services/sasl.if b/policy/modules/services/sasl.if
index 87caf806e..7ba2e2418 100644
--- a/policy/modules/services/sasl.if
+++ b/policy/modules/services/sasl.if
@@ -38,6 +38,25 @@ interface(`sasl_read_keytab',`
 	read_files_pattern($1, saslauthd_keytab_t, saslauthd_keytab_t)
 ')
 
+########################################
+## <summary>
+##	Memory map and read SASL keytab files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`sasl_mmap_read_keytab',`
+	gen_require(`
+		type saslauthd_keytab_t;
+	')
+
+	files_search_etc($1)
+	mmap_read_files_pattern($1, saslauthd_keytab_t, saslauthd_keytab_t)
+')
+
 ########################################
 ## <summary>
 ##	All of the rules required to