[gentoo-commits] proj/hardened-refpolicy:mailinfra commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     a2d1f61b74fda94cd0553ba94174bace791cbeee
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sat Aug 23 19:15:48 2014 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Sat Aug 23 19:15:48 2014 +0000
URL:        http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=a2d1f61b

Introduce postfix_user_sendmail_privs

---
 policy/modules/contrib/postfix.if | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/policy/modules/contrib/postfix.if b/policy/modules/contrib/postfix.if
index 8e7d1e7..2e1df2c 100644
--- a/policy/modules/contrib/postfix.if
+++ b/policy/modules/contrib/postfix.if
@@ -756,3 +756,33 @@ interface(`postfix_admin',`
 		can_exec($1, postfix_showq_exec_t)
 	')
 ')
+
+# ifdef distro_gentoo
+
+#########################################
+## <summary>
+##	Assign privileges for Postfix sendmail
+## </summary>
+## <param name="domain:>
+##	<summary>
+##	Domain to assign privileges to
+##	</summary>
+## </param>
+#
+interface(`postfix_user_sendmail_privs',`
+	allow $1 self:process { setrlimit };
+	allow $1 self:tcp_socket create_socket_perms;
+	allow $1 self:unix_dgram_socket create_socket_perms;
+
+	kernel_read_network_state($1)
+
+	logging_send_syslog_msg($1)
+
+	auth_use_nsswitch($1)
+
+	optional_policy(`
+		postfix_domtrans_postdrop($1)
+		postfix_read_config($1)
+		postfix_read_spool_files($1)
+	')
+')