[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/

["Jason Zaman" <perfinion@gentoo.org>]

commit:     525fb46b40e90c3149d8807139a4ed407f069007
Author:     Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Sun Nov  7 01:23:18 2021 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Thu Nov 11 21:26:50 2021 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=525fb46b

certbot, various: allow various services to read certbot certs

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/services/apache.te  |  4 ++++
 policy/modules/services/certbot.if | 20 ++++++++++++++++++++
 policy/modules/services/dovecot.te |  4 ++++
 policy/modules/services/exim.te    |  4 ++++
 policy/modules/services/jabber.te  |  4 ++++
 policy/modules/services/postfix.te | 12 ++++++++++++
 6 files changed, 48 insertions(+)

diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te
index 435297c1..79fdf1ae 100644
--- a/policy/modules/services/apache.te
+++ b/policy/modules/services/apache.te
@@ -757,6 +757,10 @@ optional_policy(`
 	calamaris_read_www_files(httpd_t)
 ')
 
+optional_policy(`
+	certbot_read_lib(httpd_t)
+')
+
 optional_policy(`
 	clamav_domtrans_clamscan(httpd_t)
 ')

diff --git a/policy/modules/services/certbot.if b/policy/modules/services/certbot.if
index d2276ef2..3a1141dc 100644
--- a/policy/modules/services/certbot.if
+++ b/policy/modules/services/certbot.if
@@ -44,3 +44,23 @@ interface(`certbot_run',`
 	certbot_domtrans($1)
 	role $2 types certbot_t;
 ')
+
+########################################
+## <summary>
+##	Read TLS certificates and keys
+##	generated by certbot.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`certbot_read_lib',`
+	gen_require(`
+		type certbot_lib_t;
+	')
+
+	search_dirs_pattern($1, certbot_lib_t, certbot_lib_t)
+	read_files_pattern($1, certbot_lib_t, certbot_lib_t)
+')

diff --git a/policy/modules/services/dovecot.te b/policy/modules/services/dovecot.te
index e6ca365a..b73c2211 100644
--- a/policy/modules/services/dovecot.te
+++ b/policy/modules/services/dovecot.te
@@ -198,6 +198,10 @@ tunable_policy(`use_samba_home_dirs',`
 	fs_manage_cifs_symlinks(dovecot_t)
 ')
 
+optional_policy(`
+	certbot_read_lib(dovecot_t)
+')
+
 optional_policy(`
 	kerberos_manage_host_rcache(dovecot_t)
 	kerberos_read_keytab(dovecot_t)

diff --git a/policy/modules/services/exim.te b/policy/modules/services/exim.te
index 6e106976..541747ba 100644
--- a/policy/modules/services/exim.te
+++ b/policy/modules/services/exim.te
@@ -182,6 +182,10 @@ tunable_policy(`exim_manage_user_files',`
 	userdom_manage_user_tmp_files(exim_t)
 ')
 
+optional_policy(`
+	certbot_read_lib(exim_t)
+')
+
 optional_policy(`
 	clamav_domtrans_clamscan(exim_t)
 	clamav_scannable_files(exim_spool_t)

diff --git a/policy/modules/services/jabber.te b/policy/modules/services/jabber.te
index 16f2d82d..827f9a20 100644
--- a/policy/modules/services/jabber.te
+++ b/policy/modules/services/jabber.te
@@ -121,6 +121,10 @@ sysnet_read_config(jabberd_t)
 userdom_dontaudit_use_unpriv_user_fds(jabberd_t)
 userdom_dontaudit_search_user_home_dirs(jabberd_t)
 
+optional_policy(`
+	certbot_read_lib(jabberd_t)
+')
+
 ########################################
 #
 # Router local policy

diff --git a/policy/modules/services/postfix.te b/policy/modules/services/postfix.te
index 25e31623..d6e284e4 100644
--- a/policy/modules/services/postfix.te
+++ b/policy/modules/services/postfix.te
@@ -312,6 +312,10 @@ mta_spec_filetrans_aliases(postfix_master_t, postfix_etc_t, file)
 mta_read_sendmail_bin(postfix_master_t)
 mta_getattr_spool(postfix_master_t)
 
+optional_policy(`
+	certbot_read_lib(postfix_master_t)
+')
+
 optional_policy(`
 	cyrus_stream_connect(postfix_master_t)
 ')
@@ -763,6 +767,10 @@ rw_files_pattern(postfix_smtp_t, postfix_spool_maildrop_t, postfix_spool_maildro
 
 corenet_tcp_bind_generic_node(postfix_smtp_t)
 
+optional_policy(`
+	certbot_read_lib(postfix_smtp_t)
+')
+
 optional_policy(`
 	cyrus_stream_connect(postfix_smtp_t)
 ')
@@ -800,6 +808,10 @@ fs_getattr_all_fs(postfix_smtpd_t)
 mta_read_aliases(postfix_smtpd_t)
 mta_map_aliases(postfix_smtpd_t)
 
+optional_policy(`
+	certbot_read_lib(postfix_smtpd_t)
+')
+
 optional_policy(`
 	dbus_send_system_bus(postfix_smtp_t)
 	dbus_system_bus_client(postfix_smtp_t)