I have one question about nested subjects: why must I explicitly state each executable to be nested in the original subject, even if they are included under an object already? For example, in the /usr/lib64/postfix/master subject I have /usr/lib64 as rx, yet I get an error unless I specify each executable under /usr/lib64/postfix that will be nested.
- Code: Select all
# common objects to postfix worker processes
define postfix {
/dev/log rw
/dev/urandom r
/etc r
/lib64 rx
/proc/sys/kernel/ngroups_max r
/proc/sys/kernel/version r
/usr/lib64 rx
/usr/share/zoneinfo/GB r
/var/run
/var/spool/postfix
}
# the main daemon (all other processes are children of this)
subject /usr/lib64/postfix/master dpo {
/ h
/dev/log rw
/lib64 rx
/usr/lib64 rx
/usr/lib64/postfix/anvil x
/usr/lib64/postfix/cleanup x
/usr/lib64/postfix/local x
/usr/lib64/postfix/pickup x
/usr/lib64/postfix/proxymap x
/usr/lib64/postfix/qmgr x
/usr/lib64/postfix/smtp x
/usr/lib64/postfix/smtpd x
/usr/lib64/postfix/tlsmgr x
/usr/lib64/postfix/trivial-rewrite x
/usr/share/zoneinfo/GB r
/var/spool/postfix/private rw
/var/spool/postfix/public/pickup w
/var/spool/postfix/public/qmgr w
-CAP_ALL
+CAP_DAC_OVERRIDE
+CAP_DAC_READ_SEARCH
+CAP_KILL
+CAP_SETGID
+CAP_SETUID
bind disabled
connect disabled
}
subject /usr/lib64/postfix/master:/usr/lib64/postfix/anvil o {
user_transition_allow root
group_transition_allow root
/ h
$postfix | $bad_etc
-CAP_ALL
+CAP_SETGID
+CAP_SETUID
bind 0.0.0.0/32:0 dgram ip
connect disabled
}
subject /usr/lib64/postfix/master:/usr/lib64/postfix/cleanup o {
user_transition_allow root
group_transition_allow root
/ h
/var/spool/postfix/pid rw
$postfix | $bad_etc
-CAP_ALL
+CAP_SETGID
+CAP_SETUID
bind 0.0.0.0/32:0 dgram ip
connect disabled
}
subject /usr/lib64/postfix/master:/usr/lib64/postfix/local o {
user_transition_allow root
group_transition_allow root
/ h
/proc h
/proc/stat r
/usr/bin/procmail x
/var/spool/postfix/active rw
/var/spool/postfix/pid/unix.local rw
/var/spool/postfix/private/rewrite rw
/var/tmp
$postfix | $bad_etc
-CAP_ALL
+CAP_SETGID
+CAP_SETUID
bind 0.0.0.0/32:0 dgram ip
connect disabled
}
subject /usr/lib64/postfix/master:/usr/lib64/postfix/local:/usr/bin/procmail o {
/ h
/dev/null rw
/dev/urandom r
/etc/group r
/etc/ld.so.cache r
/etc/nsswitch.conf r
/etc/passwd r
/etc/procmailrc r
/home
/home/*/.procmailrc r
/home/*/.maildir wcdl
/lib64 rx
/proc/sys/kernel/ngroups_max r
/var/run
-CAP_ALL
+CAP_DAC_OVERRIDE
+CAP_DAC_READ_SEARCH
+CAP_SETGID
+CAP_SETUID
bind disabled
connect 127.0.0.1/32:512 dgram udp
}
subject /usr/lib64/postfix/master:/usr/lib64/postfix/pickup o {
user_transition_allow root
group_transition_allow root
/ h
/var/spool/postfix/maildrop
$postfix | $bad_etc
-CAP_ALL
+CAP_SETGID
+CAP_SETUID
bind 0.0.0.0/32:0 dgram ip
connect disabled
}
subject /usr/lib64/postfix/master:/usr/lib64/postfix/proxymap o {
user_transition_allow root
group_transition_allow root
/ h
$postfix | $bad_etc
-CAP_ALL
+CAP_SETGID
+CAP_SETUID
bind 0.0.0.0/32:0 dgram ip
connect disabled
}
subject /usr/lib64/postfix/master:/usr/lib64/postfix/qmgr o {
user_transition_allow root
group_transition_allow root
/ h
$postfix | $bad_etc
-CAP_ALL
+CAP_SETGID
+CAP_SETUID
bind 0.0.0.0/32:0 dgram ip
connect disabled
}
subject /usr/lib64/postfix/master:/usr/lib64/postfix/smtp o {
user_transition_allow root
group_transition_allow root
/ h
/var/spool/postfix/pid/unix.scan rw
/var/spool/postfix/pid/unix.smtp rw
$postfix | $bad_etc
-CAP_ALL
+CAP_SETGID
+CAP_SETUID
bind 0.0.0.0/32:0 dgram ip
connect disabled
}
subject /usr/lib64/postfix/master:/usr/lib64/postfix/smtpd o {
user_transition_allow root
group_transition_allow root
/ h
/proc/stat r
/var/spool/postfix/pid rw
/var/spool/postfix/private/proxymap rw
/var/spool/postfix/private/tlsmgr rw
$postfix | $bad_etc
-CAP_ALL
+CAP_DAC_OVERRIDE
+CAP_SETGID
+CAP_SETUID
bind 0.0.0.0/32:0 dgram ip
connect disabled
}
subject /usr/lib64/postfix/master:/usr/lib64/postfix/tlsmgr o {
user_transition_allow root
group_transition_allow root
/ h
/dev/urandom r
-CAP_ALL
bind disabled
connect disabled
}
subject /usr/lib64/postfix/master:/usr/lib64/postfix/trivial-rewrite o {
user_transition_allow root
group_transition_allow root
/ h
$postfix | $bad_etc
-CAP_ALL
+CAP_SETGID
+CAP_SETUID
bind 0.0.0.0/32:0 dgram ip
connect disabled
}