--- nsaserefpolicy/policy/modules/services/exim.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/exim.if	2008-08-14 13:53:54.000000000 -0400
@@ -97,6 +97,26 @@
 
 ########################################
 ## <summary>
+##	Allow the specified domain to manage exim's log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`exim_manage_log',`
+	gen_require(`
+		type exim_log_t;
+	')
+
+	manage_files_pattern($1, exim_log_t, exim_log_t)
+	logging_search_logs($1)
+')
+
+########################################
+## <summary>
 ##	Allow the specified domain to append
 ##	exim log files.
 ## </summary>
@@ -154,3 +174,23 @@
 	manage_files_pattern($1, exim_spool_t, exim_spool_t)
 	files_search_spool($1)
 ')
+
+########################################
+## <summary>
+##	Create, read, write, and delete
+##	exim spool dirs.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`exim_manage_spool_dirs',`
+	gen_require(`
+		type exim_spool_t;
+	')
+
+	manage_dirs_pattern($1, exim_spool_t, exim_spool_t)
+	files_search_snpool($1)
+')
--- nsaserefpolicy/policy/modules/services/exim.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/exim.te	2008-08-14 13:53:54.000000000 -0400
@@ -21,9 +21,20 @@
 ## </desc>
 gen_tunable(exim_manage_user_files, false)
 
+## <desc>
+## <p>
+##     Allow exim to connect to databases (postgres, mysql)
+## </p>
+## </desc>
+gen_tunable(exim_can_connect_db, false)
+
 type exim_t;
 type exim_exec_t;
 init_daemon_domain(exim_t, exim_exec_t)
+mta_mailserver(exim_t, exim_exec_t)
+mta_mailserver_user_agent(exim_t)
+application_executable_file(exim_exec_t)
+mta_mailclient(exim_exec_t)
 
 type exim_log_t;
 logging_log_file(exim_log_t)
@@ -37,15 +48,20 @@
 type exim_var_run_t;
 files_pid_file(exim_var_run_t)
 
+type exim_script_exec_t;
+init_script_type(exim_script_exec_t)
+
 ########################################
 #
 # exim local policy
 #
 
-allow exim_t self:capability { dac_override dac_read_search setuid setgid fowner chown };
-allow exim_t self:fifo_file rw_fifo_file_perms;
+allow exim_t self:capability { chown dac_override dac_read_search fowner setuid setgid sys_resource  };
+allow exim_t self:process { setrlimit setpgid };
+allow exim_t self:fifo_file rw_file_perms;
 allow exim_t self:unix_stream_socket create_stream_socket_perms;
 allow exim_t self:tcp_socket create_stream_socket_perms;
+allow exim_t self:udp_socket create_socket_perms;
 
 can_exec(exim_t,exim_exec_t)
 
@@ -66,12 +82,15 @@
 files_pid_filetrans(exim_t, exim_var_run_t, { file dir })
 
 kernel_read_kernel_sysctls(exim_t)
-
 kernel_dontaudit_read_system_state(exim_t)
+kernel_read_network_state(exim_t)
 
 corecmd_search_bin(exim_t)
 
 corenet_all_recvfrom_unlabeled(exim_t)
+corenet_all_recvfrom_netlabel(exim_t)
+corenet_udp_sendrecv_all_if(exim_t)
+corenet_udp_sendrecv_all_nodes(exim_t)
 corenet_tcp_sendrecv_all_if(exim_t)
 corenet_tcp_sendrecv_all_nodes(exim_t)
 corenet_tcp_sendrecv_all_ports(exim_t)
@@ -82,6 +101,8 @@
 corenet_tcp_connect_smtp_port(exim_t)
 corenet_tcp_connect_ldap_port(exim_t)
 corenet_tcp_connect_inetd_child_port(exim_t)
+# connect to spamassassin
+corenet_tcp_connect_spamd_port(exim_t)
 
 dev_read_rand(exim_t)
 dev_read_urand(exim_t)
@@ -89,6 +110,8 @@
 # Init script handling
 domain_use_interactive_fds(exim_t)
 
+files_search_usr(exim_t)
+files_search_var(exim_t)
 files_read_etc_files(exim_t)
 
 auth_use_nsswitch(exim_t)
@@ -99,23 +122,86 @@
 logging_send_syslog_msg(exim_t)
 
 miscfiles_read_localization(exim_t)
+miscfiles_read_certs(exim_t)
 
-sysnet_dns_name_resolve(exim_t)
+fs_getattr_xattr_fs(exim_t)
+fs_list_inotifyfs(exim_t)
 
 unprivuser_dontaudit_search_home_dirs(exim_t)
 
 mta_read_aliases(exim_t)
-mta_rw_spool(exim_t)
+mta_read_config(exim_t)
+mta_manage_spool(exim_t)
+mta_mailserver_delivery(exim_t)
 
 sysadm_dontaudit_search_home_dirs(exim_t)
 
 tunable_policy(`exim_read_user_files',`
-	userdom_read_unpriv_users_home_content_files(exim_t)
-	userdom_read_unpriv_users_tmp_files(exim_t)
+	unprivuser_read_home_content_files(exim_t)
+	unprivuser_read_tmp_files(exim_t)
 ')
 
 tunable_policy(`exim_manage_user_files',`
-	userdom_manage_unpriv_users_home_content_dirs(exim_t)
-	userdom_read_unpriv_users_tmp_files(exim_t)
-	userdom_write_unpriv_users_tmp_files(exim_t)
+	unprivuser_manage_home_content_dirs(exim_t)
+	unprivuser_read_tmp_files(exim_t)
+	unprivuser_write_tmp_files(exim_t)
+')
+
+tunable_policy(`exim_can_connect_db',`
+	corenet_tcp_connect_mysqld_port(exim_t)
+	corenet_sendrecv_mysqld_client_packets(exim_t)
+        corenet_tcp_connect_postgresql_port(exim_t)
+        corenet_sendrecv_postgresql_client_packets(exim_t)
+')
+
+optional_policy(`
+	dovecot_auth_stream_connect(exim_t)
+')
+
+optional_policy(`
+	tunable_policy(`exim_can_connect_db',`
+		mysql_stream_connect(exim_t)
+	')
+')
+
+optional_policy(`
+	tunable_policy(`exim_can_connect_db',`
+		postgresql_stream_connect(exim_t)
+')
+')
+
+optional_policy(`
+	kerberos_keytab_template(exim, exim_t)
+')
+
+optional_policy(`
+	mailman_read_data_files(exim_t)
+	mailman_domtrans(exim_t)
+')
+
+optional_policy(`
+	procmail_domtrans(exim_t)
+')
+
+optional_policy(`
+	sasl_connect(exim_t)
+')
+
+optional_policy(`
+	cron_read_pipes(exim_t)
+	cron_rw_system_job_pipes(exim_t)
+')
+
+optional_policy(`
+	cyrus_stream_connect(exim_t)
+')
+
+optional_policy(`
+	clamav_domtrans_clamscan(exim_t)
+	clamav_stream_connect(exim_t)
+')
+
+optional_policy(`
+	spamassassin_exec(exim_t)
+	spamassassin_exec_client(exim_t)
 ')
