Bug 45917 – courier-imap-3.0.2 policy

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description petre rodan (RETIRED) 2004-03-27 12:11:25 UTC]

in 3.0.2 the courierlogger binary was moved in /usr/sbin and a symlink was provided for compatibility. 

the policy should be changed like this:

in courier-imap.te
+allow courier_tcpd_t courier_exec_t:lnk_file { read };

in courier-imap.fc
-/usr/lib/courier-imap/courierlogger --  system_u:object_r:courier_exec_t
+/usr/lib/courier-imap/courierlogger     system_u:object_r:courier_exec_t
+/usr/sbin/courierlogger             --  system_u:object_r:courier_exec_t

I will check monday if more rules must be changed on a more used server. 
on my home server I haven't found any additional inconsistences.

[Comment 1 petre rodan (RETIRED) 2004-03-29 22:55:57 UTC]

no additional policy changes were needed.
please update the policy files.

bye,
peter

[Comment 2 Chris PeBenito (RETIRED) 2004-03-30 14:25:38 UTC]

Generally we try not to give symlinks special labels.  It seems like there only needs to be these additions, since it looks like the symlink would be bin_t with the current file contexts:

allow courier_tcpd_t bin_t:lnk_file read;

fc:
/usr/sbin/courierlogger -- system_u:object_r:courier_exec_t

[Comment 3 petre rodan (RETIRED) 2004-03-30 23:15:12 UTC]

ok, it also works using your version.

[Comment 4 Chris PeBenito (RETIRED) 2004-04-06 13:14:45 UTC]

selinux-courier-imap-20040406 committed to portage