Postfix pipe command and python scripts

Fabrizio Buratta extremoburo at
Fri May 30 08:05:38 UTC 2008

> Looking at the policy postfix_pipe_t is able to write to postfix_spool_t
> or postfix_var_run_t,  So you could change the labeling of the file to
> one of those context.
I realized that postfix_pipe_t ( postfix/pipe command actually runs
under  postfix_pipe_exec_t context ) cannot do
write, add_name , remove_name and unlink  either postfix_spool_t or
postfix_var_run_t therefore i had to set it myself.

I'll resume what i've done :

1 - I put my db in  /var/spool/postfix/vacation
2 - chcon -u system_u -r object_r -t postfix_spool_t -R
3 - chown -R postfix:vacation /var/spool/postfix/vacation
4 - i created vacation.te :

   module vacationpolicy 1.0;

require {
       type postfix_pipe_t;
       type postfix_spool_t;
       class dir { write remove_name add_name };
       class file { create unlink };

#============= postfix_pipe_t ==============
allow postfix_pipe_t postfix_spool_t:dir { write remove_name add_name };
allow postfix_pipe_t postfix_spool_t:file { create unlink };

5 - I created a package and installed it

It worked

Thanks for your help!


More information about the fedora-selinux-list mailing list