commit: add37312bb35e4b3c6a802074c75f3f94e2a9fc6
Author: Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Wed Dec 7 16:00:03 2022 +0000
Commit: Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Tue Dec 13 19:07:48 2022 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=add37312
postfix, sasl: allow postfix smtp daemon to read SASL keytab
Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>
policy/modules/services/postfix.te | 1 +
policy/modules/services/sasl.if | 19 +++++++++++++++++++
2 files changed, 20 insertions(+)
diff --git a/policy/modules/services/postfix.te
b/policy/modules/services/postfix.te
index e546e7e62..7b158e705 100644
--- a/policy/modules/services/postfix.te
+++ b/policy/modules/services/postfix.te
@@ -839,6 +839,7 @@ optional_policy(`
optional_policy(`
sasl_connect(postfix_smtpd_t)
+ sasl_read_keytab(postfix_smtpd_t)
')
optional_policy(`
diff --git a/policy/modules/services/sasl.if b/policy/modules/services/sasl.if
index e1e15648f..87caf806e 100644
--- a/policy/modules/services/sasl.if
+++ b/policy/modules/services/sasl.if
@@ -19,6 +19,25 @@ interface(`sasl_connect',`
stream_connect_pattern($1, saslauthd_runtime_t, saslauthd_runtime_t,
saslauthd_t)
')
+########################################
+## <summary>
+## Read SASL keytab files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`sasl_read_keytab',`
+ gen_require(`
+ type saslauthd_keytab_t;
+ ')
+
+ files_search_etc($1)
+ read_files_pattern($1, saslauthd_keytab_t, saslauthd_keytab_t)
+')
+
########################################
## <summary>
## All of the rules required to
