[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     23abdcb627759c498b77d8c397098e646703376b
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sat Nov 17 18:18:24 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sat Nov 17 18:18:24 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=23abdcb6

Postfix deferred queue should not mark mails as postfix_spool_maildrop_t

Postfix /moves/ the mail files between the queues as they are processed. Mails
that cannot be delivered currently are pushed towards the deferred queue.
However, when this occurs, the mail file retains its context (as it is moved,
not copied) for postfix_spool_t.

If we would relabel the system or directory at that point, the mail gets labeled
postfix_spool_maildrop_t. When a new attempt is made to deliver, the postfix
daemons, like local, are not able to read (and process) the mail anymore since
they do not hold read rights on the postfix_spool_maildrop_t type.

Only mark the deferred directory as postfix_spool_maildrop_t solves this.

---
 policy/modules/contrib/postfix.fc |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/policy/modules/contrib/postfix.fc b/policy/modules/contrib/postfix.fc
index 2cdaf1c..7d0b138 100644
--- a/policy/modules/contrib/postfix.fc
+++ b/policy/modules/contrib/postfix.fc
@@ -47,7 +47,7 @@
 /var/lib/postfix.*	gen_context(system_u:object_r:postfix_data_t,s0)
 
 /var/spool/postfix.*	gen_context(system_u:object_r:postfix_spool_t,s0)
-/var/spool/postfix/deferred(/.*)?	gen_context(system_u:object_r:postfix_spool_maildrop_t,s0)
+/var/spool/postfix/deferred(/.*)?	-d	gen_context(system_u:object_r:postfix_spool_maildrop_t,s0)
 /var/spool/postfix/defer(/.*)?	gen_context(system_u:object_r:postfix_spool_maildrop_t,s0)
 /var/spool/postfix/maildrop(/.*)?	gen_context(system_u:object_r:postfix_spool_maildrop_t,s0)
 /var/spool/postfix/pid/.*	gen_context(system_u:object_r:postfix_var_run_t,s0)