191 lines
3.8 KiB
Plaintext
191 lines
3.8 KiB
Plaintext
## <summary>Sympa mailing list manager</summary>
|
|
## <desc>
|
|
## Sympa is a popular mailing list manager.
|
|
## https://www.sympa.org/
|
|
## </desc>
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow appending to sympa_var_t (for error log)
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`sympa_append_inherited_var_files',`
|
|
gen_require(`
|
|
type sympa_t, sympa_var_t;
|
|
')
|
|
|
|
allow $1 sympa_t:fd use;
|
|
allow $1 sympa_var_t:file append_inherited_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow reading sympa_var_t files
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`sympa_read_var_files',`
|
|
gen_require(`
|
|
type sympa_var_t;
|
|
')
|
|
|
|
allow $1 sympa_var_t:dir list_dir_perms;
|
|
allow $1 sympa_var_t:file read_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow managing sympa_var_t files
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`sympa_manage_var_files',`
|
|
gen_require(`
|
|
type sympa_var_t;
|
|
')
|
|
|
|
manage_files_pattern($1, sympa_var_t, sympa_var_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow mapping sympa_var_t files
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`sympa_map_var_files',`
|
|
gen_require(`
|
|
type sympa_var_t;
|
|
')
|
|
|
|
allow $1 sympa_var_t:file map;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Transition to sympa_t when executing sympa_exec_t
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`sympa_domtrans',`
|
|
gen_require(`
|
|
type sympa_exec_t, sympa_t;
|
|
')
|
|
|
|
domain_auto_transition_pattern($1, sympa_exec_t, sympa_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Dontaudit access to inherited sympa tcp sockets
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`symba_dontaudit_rw_inherited_tcp_sockets',`
|
|
gen_require(`
|
|
type sympa_t;
|
|
')
|
|
|
|
dontaudit $1 sympa_t:tcp_socket { read write };
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow reading sympa config files
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to allow
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`sympa_read_conf',`
|
|
gen_require(`
|
|
type sympa_etc_t;
|
|
')
|
|
|
|
allow $1 sympa_etc_t:dir list_dir_perms;
|
|
allow $1 sympa_etc_t:file read_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow rw sympa runtime dirs and manage sympa runtime files
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to allow
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`sympa_manage_runtime_files',`
|
|
gen_require(`
|
|
type sympa_runtime_t;
|
|
')
|
|
|
|
allow $1 sympa_runtime_t:dir rw_dir_perms;
|
|
allow $1 sympa_runtime_t:file manage_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow rw sympa runtime dirs and manage sympa runtime sock files
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to allow
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`sympa_manage_runtime_sock_files',`
|
|
gen_require(`
|
|
type sympa_runtime_t;
|
|
')
|
|
|
|
allow $1 sympa_runtime_t:dir rw_dir_perms;
|
|
allow $1 sympa_runtime_t:sock_file { setattr create unlink write };
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow domain to connect to sympa socket
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to allow
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`sympa_connect_runtime_sock_files',`
|
|
gen_require(`
|
|
type sympa_t;
|
|
')
|
|
|
|
allow $1 sympa_t:unix_stream_socket connectto;
|
|
')
|