Bugzilla Bug 35654

# /usr/sbin/sendmail is a symlink, so ...
allow crond_t sendmail_exec_t:lnk_file { read };

# iptables-save also needs this:
allow iptables_t proc_net_t:dir { search };
allow iptables_t proc_net_t:file { read getattr };
read_locale(iptables_t)

# needed in order to upgrade a ssh daemon ;)
ifdef(`daemontools.te', `
allow sshd_t self:capability { kill };
allow sshd_t self:process { signal };
')

The 2nd and third blocks are committed, but not the first one.  The convention
is that symlinks to binaries should only be bin_t or sbin_t, and the target of
the symlink should have the transition type, sendmail_exec_t in this case. 
Please adjust your qmail labeling.

ok. i'm removing the /usr/sbin/sendmail definition from qmail.fc.
you are most welcome do the same in http://bugs.gentoo.org/attachment.cgi?id=21928&action=view  ;)

is there a public document that contains conventions like this?

bye,
peter

I dont know of any doc that has this or other conventions; there are few people
that do much work on policy.