diff --git a/policy/modules/contrib/ddclient.if b/policy/modules/contrib/ddclient.if index 62aede25b1..c2843caee4 100644 --- a/policy/modules/contrib/ddclient.if +++ b/policy/modules/contrib/ddclient.if @@ -118,3 +118,37 @@ interface(`ddclient_getattr_pid_files',` getattr_files_pattern($1, ddclient_var_run_t, ddclient_var_run_t) ') + +######################################## +## +## Create objects in the ddclient home directory +## with an automatic type transition to a specified type +## +## +## +## Domain allowed access. +## +## +## +## +## The type of the object being created. +## +## +## +## +## The class of the object being created. +## +## +## +## +## The name of the object being created. +## +## +# +interface(`ddclient_var_filetrans',` + gen_require(` + type ddclient_var_t; + ') + + filetrans_pattern($1, ddclient_var_t, $2, $3, $4) +') diff --git a/policy/modules/contrib/mta.fc b/policy/modules/contrib/mta.fc index 5ae420d696..1b545a04ba 100644 --- a/policy/modules/contrib/mta.fc +++ b/policy/modules/contrib/mta.fc @@ -16,6 +16,7 @@ ifdef(`distro_redhat',` /etc/postfix/aliases.* gen_context(system_u:object_r:etc_aliases_t,s0) ') +/var/cache/ddclient/\.esmtp_queue(/.*)? gen_context(system_u:object_r:mail_home_rw_t,s0) /var/lib/arpwatch/\.esmtp_queue(/.*)? gen_context(system_u:object_r:mail_home_rw_t,s0) /root/\.forward -- gen_context(system_u:object_r:mail_home_t,s0) diff --git a/policy/modules/contrib/mta.te b/policy/modules/contrib/mta.te index c96a8c8754..a07bd4f85b 100644 --- a/policy/modules/contrib/mta.te +++ b/policy/modules/contrib/mta.te @@ -130,6 +130,10 @@ optional_policy(` courier_rw_spool_pipes(user_mail_domain) ') +optional_policy(` + ddclient_var_filetrans(system_mail_t, mail_home_rw_t, dir, ".esmtp_queue") +') + optional_policy(` exim_domtrans(user_mail_domain) exim_manage_log(user_mail_domain)