commit: a2d1f61b74fda94cd0553ba94174bace791cbeee
Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sat Aug 23 19:15:48 2014 +0000
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Sat Aug 23 19:15:48 2014 +0000
URL:
http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=a2d1f61b
Introduce postfix_user_sendmail_privs
---
policy/modules/contrib/postfix.if | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/policy/modules/contrib/postfix.if
b/policy/modules/contrib/postfix.if
index 8e7d1e7..2e1df2c 100644
--- a/policy/modules/contrib/postfix.if
+++ b/policy/modules/contrib/postfix.if
@@ -756,3 +756,33 @@ interface(`postfix_admin',`
can_exec($1, postfix_showq_exec_t)
')
')
+
+# ifdef distro_gentoo
+
+#########################################
+## <summary>
+## Assign privileges for Postfix sendmail
+## </summary>
+## <param name="domain:>
+## <summary>
+## Domain to assign privileges to
+## </summary>
+## </param>
+#
+interface(`postfix_user_sendmail_privs',`
+ allow $1 self:process { setrlimit };
+ allow $1 self:tcp_socket create_socket_perms;
+ allow $1 self:unix_dgram_socket create_socket_perms;
+
+ kernel_read_network_state($1)
+
+ logging_send_syslog_msg($1)
+
+ auth_use_nsswitch($1)
+
+ optional_policy(`
+ postfix_domtrans_postdrop($1)
+ postfix_read_config($1)
+ postfix_read_spool_files($1)
+ ')
+')
