Bug 45917 - courier-imap-3.0.2 policy
Bug#: 45917 Product:  Gentoo Linux Version: unspecified Platform: All
OS/Version: All Status: RESOLVED Severity: normal Priority: P2
Resolution: FIXED Assigned To: pebenito@gentoo.org Reported By: kaiowas@gentoo.org
Component: Hardened
URL: 
Summary: courier-imap-3.0.2 policy
Keywords:  
Status Whiteboard: 
Opened: 2004-03-27 12:11 0000
Description:   Opened: 2004-03-27 12:11 0000 
in 3.0.2 the courierlogger binary was moved in /usr/sbin and a symlink was
provided for compatibility. 

the policy should be changed like this:

in courier-imap.te
+allow courier_tcpd_t courier_exec_t:lnk_file { read };

in courier-imap.fc
-/usr/lib/courier-imap/courierlogger --  system_u:object_r:courier_exec_t
+/usr/lib/courier-imap/courierlogger     system_u:object_r:courier_exec_t
+/usr/sbin/courierlogger             --  system_u:object_r:courier_exec_t

I will check monday if more rules must be changed on a more used server. 
on my home server I haven't found any additional inconsistences.

------- Comment #1 From petre rodan (RETIRED) 2004-03-29 22:55:57 0000 ------- 
no additional policy changes were needed.
please update the policy files.

bye,
peter

------- Comment #2 From Chris PeBenito 2004-03-30 14:25:38 0000 ------- 
Generally we try not to give symlinks special labels.  It seems like there only
needs to be these additions, since it looks like the symlink would be bin_t
with the current file contexts:

allow courier_tcpd_t bin_t:lnk_file read;

fc:
/usr/sbin/courierlogger -- system_u:object_r:courier_exec_t

------- Comment #3 From petre rodan (RETIRED) 2004-03-30 23:15:12 0000 ------- 
ok, it also works using your version.

------- Comment #4 From Chris PeBenito 2004-04-06 13:14:45 0000 ------- 
selinux-courier-imap-20040406 committed to portage