add content

sec-policy/selinux-doveadm/files/doveadm.te

@@ -0,0 +1,100 @@
+policy_module(doveadm, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+attribute_role dovecot_adm_roles;
+roleattribute system_r lego_roles;
+
+type dovecot_adm_t, dovecot_domain;
+type dovecot_adm_exec_t;
+domain_type(dovecot_adm_t)
+domain_entry_file(dovecot_adm_t, dovecot_adm_exec_t)
+role system_r types dovecot_adm_t;
+
+########################################
+#
+# lego local policy
+#
+
+allow lego_t self:process getsched;
+sysnet_read_config(lego_t)
+files_search_var_lib(lego_t)
+
+userdom_use_user_ptys(lego_t)
+domain_use_interactive_fds(lego_t)
+
+corenet_tcp_connect_http_port(lego_t)
+allow lego_t self:tcp_socket create_socket_perms;
+allow lego_t self:udp_socket create_socket_perms;
+allow lego_t self:netlink_route_socket r_netlink_socket_perms;
+
+manage_dirs_pattern(lego_t, lego_data_t, lego_data_t)
+manage_files_pattern(lego_t, lego_data_t, lego_data_t)
+manage_lnk_files_pattern(lego_t, lego_data_t, lego_data_t)
+files_etc_filetrans(lego_t, lego_data_t, { dir file lnk_file })
+
+miscfiles_read_generic_certs(lego_t)
+miscfiles_read_localization(lego_t)
+
+tunable_policy(`lego_use_homedirs',`
+	userdom_manage_user_home_content_dirs(lego_t)
+	userdom_manage_user_home_content_files(lego_t)
+')
+
+optional_policy(`
+    gen_require(`
+       type sysadm_t;
+       role sysadm_r;
+    ')
+    lego_role(sysadm_r, sysadm_t)
+')
+
+optional_policy(`
+    gen_require(`
+       role user_r;
+       type user_t;
+    ')
+    lego_role(user_r, user_t)
+')
+
+optional_policy(`
+    gen_require(`
+       role staff_r;
+       type staff_t;
+    ')
+    lego_role(staff_r, staff_t)
+')
+
+optional_policy(`
+    gen_require(`
+       type nginx_t;
+    ')
+    lego_read_data_files(nginx_t)
+')
+
+optional_policy(`
+    gen_require(`
+       type dovecot_t;
+    ')
+    lego_read_data_files(dovecot_t)
+')
+
+optional_policy(`
+    gen_require(`
+       type exim_t;
+    ')
+    lego_read_data_files(exim_t)
+')
+
+optional_policy(`
+    gen_require(`
+       type system_cronjob_t, system_cronjob_tmp_t;
+    ')
+        cron_system_entry(lego_t, lego_exec_t)
+	allow system_cronjob_t lego_data_t:file setattr;
+	allow lego_t system_cronjob_tmp_t:file write;
+')
+