From Debian package 0.2.20100524-5 * Label /var/run/spamass as spamass_milter_data_t * Don't include /usr/sbin/spamass-milter and /var/spool/postfix/spamass in spamassassin.fc as they are in milter.fc Label /var/spool/postfix/spamass as spamass_milter_data_t Index: policy/modules/services/milter.fc =================================================================== --- policy/modules/services/milter.fc.orig +++ policy/modules/services/milter.fc @@ -8,6 +8,8 @@ /var/run/milter-greylist(/.*)? gen_context(system_u:object_r:greylist_milter_data_t,s0) /var/run/milter-greylist\.pid -- gen_context(system_u:object_r:greylist_milter_data_t,s0) /var/run/spamass-milter(/.*)? gen_context(system_u:object_r:spamass_milter_data_t,s0) +/var/run/spamass(/.*)? gen_context(system_u:object_r:spamass_milter_data_t,s0) /var/run/spamass-milter\.pid -- gen_context(system_u:object_r:spamass_milter_data_t,s0) /var/spool/milter-regex(/.*)? gen_context(system_u:object_r:regex_milter_data_t,s0) +/var/spool/postfix/spamass(/.*)? gen_context(system_u:object_r:spamass_milter_data_t,s0) Index: policy/modules/services/spamassassin.fc =================================================================== --- policy/modules/services/spamassassin.fc.orig +++ policy/modules/services/spamassassin.fc @@ -6,7 +6,6 @@ /usr/bin/spamd -- gen_context(system_u:object_r:spamd_exec_t,s0) /usr/sbin/spamd -- gen_context(system_u:object_r:spamd_exec_t,s0) -/usr/sbin/spamass-milter -- gen_context(system_u:object_r:spamd_exec_t,s0) /var/lib/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_lib_t,s0) @@ -14,4 +13,3 @@ /var/spool/spamassassin(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0) /var/spool/spamd(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0) -/var/spool/postfix/spamass(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) Index: policy/modules/services/milter.te =================================================================== --- policy/modules/services/milter.te.orig +++ policy/modules/services/milter.te @@ -20,6 +20,10 @@ type spamass_milter_state_t; files_type(spamass_milter_state_t) +files_pid_file(spamass_milter_data_t) +files_pid_filetrans(spamass_milter_t, spamass_milter_data_t, { file sock_file }) +allow spamass_milter_t spamass_milter_data_t:{ file sock_file } manage_file_perms; + ######################################## # # milter-greylist local policy @@ -94,3 +98,7 @@ optional_policy(` spamassassin_domtrans_client(spamass_milter_t) ') + +optional_policy(` + postfix_search_spool(spamass_milter_t) +')