--- nsaserefpolicy/policy/modules/services/postfix.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/postfix.fc	2008-08-14 13:53:54.000000000 -0400
@@ -29,12 +29,10 @@
 /usr/lib/postfix/smtpd	--	gen_context(system_u:object_r:postfix_smtpd_exec_t,s0)
 /usr/lib/postfix/bounce	--	gen_context(system_u:object_r:postfix_bounce_exec_t,s0)
 /usr/lib/postfix/pipe	--	gen_context(system_u:object_r:postfix_pipe_exec_t,s0)
-/usr/lib/postfix/virtual --	gen_context(system_u:object_r:postfix_virtual_exec_t,s0)
 ')
 /etc/postfix/postfix-script.* -- gen_context(system_u:object_r:postfix_exec_t,s0)
 /etc/postfix/prng_exch	--	gen_context(system_u:object_r:postfix_prng_t,s0)
 /usr/sbin/postalias	--	gen_context(system_u:object_r:postfix_master_exec_t,s0)
-/usr/sbin/postcat	--	gen_context(system_u:object_r:postfix_master_exec_t,s0)
 /usr/sbin/postdrop	--	gen_context(system_u:object_r:postfix_postdrop_exec_t,s0)
 /usr/sbin/postfix	--	gen_context(system_u:object_r:postfix_master_exec_t,s0)
 /usr/sbin/postkick	--	gen_context(system_u:object_r:postfix_master_exec_t,s0)
@@ -43,9 +41,7 @@
 /usr/sbin/postmap	--	gen_context(system_u:object_r:postfix_map_exec_t,s0)
 /usr/sbin/postqueue	--	gen_context(system_u:object_r:postfix_postqueue_exec_t,s0)
 /usr/sbin/postsuper	--	gen_context(system_u:object_r:postfix_master_exec_t,s0)
-
-/var/lib/postfix(/.*)?		gen_context(system_u:object_r:postfix_data_t,s0)
-
+/var/lib/postfix(/.*)?		gen_context(system_u:object_r:postfix_var_lib_t,s0)
 /var/spool/postfix(/.*)?		gen_context(system_u:object_r:postfix_spool_t,s0)
 /var/spool/postfix/maildrop(/.*)? gen_context(system_u:object_r:postfix_spool_maildrop_t,s0)
 /var/spool/postfix/pid/.*	gen_context(system_u:object_r:postfix_var_run_t,s0)
--- nsaserefpolicy/policy/modules/services/postfix.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/postfix.if	2008-08-14 13:53:54.000000000 -0400
@@ -211,9 +211,8 @@
 		type postfix_etc_t;
 	')
 
-	allow $1 postfix_etc_t:dir { getattr read search };
-	allow $1 postfix_etc_t:file { read getattr };
-	allow $1 postfix_etc_t:lnk_file { getattr read };
+	read_files_pattern($1, postfix_etc_t, postfix_etc_t)
+	read_lnk_files_pattern($1, postfix_etc_t, postfix_etc_t)
 	files_search_etc($1)
 ')
 
@@ -421,7 +420,7 @@
 ##	</summary>
 ## </param>
 #
-interface(`postfix_create_pivate_sockets',`
+interface(`postfix_create_private_sockets',`
 	gen_require(`
 		type postfix_private_t;
 	')
@@ -432,6 +431,26 @@
 
 ########################################
 ## <summary>
+##	manage named socket in a postfix private directory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`postfix_manage_private_sockets',`
+	gen_require(`
+		type postfix_private_t;
+	')
+
+	allow $1 postfix_private_t:dir list_dir_perms;
+	manage_sock_files_pattern($1, postfix_private_t, postfix_private_t)
+')
+
+
+########################################
+## <summary>
 ##	Execute the master postfix program in the
 ##	postfix_master domain.
 ## </summary>
@@ -508,6 +527,25 @@
 
 ########################################
 ## <summary>
+##	Manage postfix mail spool files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`postfix_manage_spool_files',`
+	gen_require(`
+		type postfix_spool_t;
+	')
+
+	files_search_spool($1)
+	manage_files_pattern($1, postfix_spool_t, postfix_spool_t)
+')
+
+########################################
+## <summary>
 ##	Execute postfix user mail programs
 ##	in their respective domains.
 ## </summary>
--- nsaserefpolicy/policy/modules/services/postfix.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/postfix.te	2008-08-14 13:53:54.000000000 -0400
@@ -6,6 +6,14 @@
 # Declarations
 #
 
+## <desc>
+## <p>
+## Allow postfix_local domain full write access to mail_spool directories
+## 
+## </p>
+## </desc>
+gen_tunable(allow_postfix_local_write_mail_spool, false)
+
 attribute postfix_user_domains;
 # domains that transition to the
 # postfix user domains
@@ -19,7 +27,7 @@
 postfix_server_domain_template(cleanup)
 
 type postfix_etc_t;
-files_type(postfix_etc_t)
+files_config_file(postfix_etc_t)
 
 type postfix_exec_t;
 application_executable_file(postfix_exec_t)
@@ -27,6 +35,10 @@
 postfix_server_domain_template(local)
 mta_mailserver_delivery(postfix_local_t)
 
+tunable_policy(`allow_postfix_local_write_mail_spool',`
+	mta_manage_spool(postfix_local_t)
+')
+
 type postfix_local_tmp_t;
 files_tmp_file(postfix_local_tmp_t)
 
@@ -34,6 +46,7 @@
 type postfix_map_t;
 type postfix_map_exec_t;
 application_domain(postfix_map_t, postfix_map_exec_t)
+role system_r types postfix_map_t;
 
 type postfix_map_tmp_t;
 files_tmp_file(postfix_map_tmp_t)
@@ -80,13 +93,12 @@
 type postfix_public_t;
 files_type(postfix_public_t)
 
+type postfix_var_lib_t;
+files_type(postfix_var_lib_t)
+
 type postfix_var_run_t;
 files_pid_file(postfix_var_run_t)
 
-# the data_directory config parameter
-type postfix_data_t;
-files_type(postfix_data_t)
-
 postfix_server_domain_template(virtual)
 mta_mailserver_delivery(postfix_virtual_t)
 
@@ -103,14 +115,12 @@
 allow postfix_master_t self:fifo_file rw_fifo_file_perms;
 allow postfix_master_t self:tcp_socket create_stream_socket_perms;
 allow postfix_master_t self:udp_socket create_socket_perms;
+allow postfix_master_t self:process setrlimit;
 
 allow postfix_master_t postfix_etc_t:file rw_file_perms;
 
 can_exec(postfix_master_t,postfix_exec_t)
 
-allow postfix_master_t postfix_data_t:dir manage_dir_perms;
-allow postfix_master_t postfix_data_t:file manage_file_perms;
-
 allow postfix_master_t postfix_map_exec_t:file { mmap_file_perms ioctl lock };
 
 allow postfix_master_t postfix_postdrop_exec_t:file getattr;
@@ -129,6 +139,10 @@
 
 domtrans_pattern(postfix_master_t, postfix_showq_exec_t, postfix_showq_t)
 
+manage_dirs_pattern(postfix_master_t, postfix_var_lib_t, postfix_var_lib_t)
+manage_files_pattern(postfix_master_t, postfix_var_lib_t, postfix_var_lib_t)
+files_search_var_lib(postfix_master_t)
+
 # allow access to deferred queue and allow removing bogus incoming entries
 manage_dirs_pattern(postfix_master_t, postfix_spool_t, postfix_spool_t)
 manage_files_pattern(postfix_master_t, postfix_spool_t, postfix_spool_t)
@@ -181,12 +195,17 @@
 
 mta_rw_aliases(postfix_master_t)
 mta_read_sendmail_bin(postfix_master_t)
+mta_getattr_spool(postfix_master_t)
 
 optional_policy(`
 	cyrus_stream_connect(postfix_master_t)
 ')
 
 optional_policy(`
+	kerberos_keytab_template(postfix, postfix_t)
+')
+
+optional_policy(`
 #	for postalias
 	mailman_manage_data_files(postfix_master_t)
 ')
@@ -255,6 +274,10 @@
 
 corecmd_exec_bin(postfix_cleanup_t)
 
+optional_policy(`
+	mailman_read_data_files(postfix_cleanup_t)
+')
+
 ########################################
 #
 # Postfix local local policy
@@ -280,18 +303,25 @@
 
 files_read_etc_files(postfix_local_t)
 
+logging_dontaudit_search_logs(postfix_local_t)
+
 mta_read_aliases(postfix_local_t)
 mta_delete_spool(postfix_local_t)
 # For reading spamassasin
 mta_read_config(postfix_local_t)
 
+domtrans_pattern(postfix_local_t, postfix_postdrop_exec_t, postfix_postdrop_t)
+
 optional_policy(`
 	clamav_search_lib(postfix_local_t)
+	clamav_exec_clamscan(postfix_local_t)
 ')
 
 optional_policy(`
 #	for postalias
 	mailman_manage_data_files(postfix_local_t)
+	mailman_append_log(postfix_local_t)
+	mailman_read_log(postfix_local_t)
 ')
 
 optional_policy(`
@@ -302,8 +332,7 @@
 #
 # Postfix map local policy
 #
-
-allow postfix_map_t self:capability setgid;
+allow postfix_map_t self:capability { dac_override setgid setuid };
 allow postfix_map_t self:unix_stream_socket create_stream_socket_perms;
 allow postfix_map_t self:unix_dgram_socket create_socket_perms;
 allow postfix_map_t self:tcp_socket create_stream_socket_perms;
@@ -353,8 +382,6 @@
 
 miscfiles_read_localization(postfix_map_t)
 
-seutil_read_config(postfix_map_t)
-
 tunable_policy(`read_default_t',`
 	files_list_default(postfix_map_t)
 	files_read_default_files(postfix_map_t)
@@ -367,6 +394,11 @@
 	locallogin_dontaudit_use_fds(postfix_map_t)
 ')
 
+optional_policy(`
+#	for postalias
+	mailman_manage_data_files(postfix_map_t)
+')
+
 ########################################
 #
 # Postfix pickup local policy
@@ -391,6 +423,7 @@
 #
 
 allow postfix_pipe_t self:fifo_file rw_fifo_file_perms;
+allow postfix_pipe_t self:process setrlimit;
 
 write_sock_files_pattern(postfix_pipe_t, postfix_private_t, postfix_private_t)
 
@@ -398,6 +431,12 @@
 
 rw_files_pattern(postfix_pipe_t, postfix_spool_t, postfix_spool_t)
 
+domtrans_pattern(postfix_pipe_t, postfix_postdrop_exec_t, postfix_postdrop_t)
+
+optional_policy(`
+	dovecot_domtrans_deliver(postfix_pipe_t)
+')
+
 optional_policy(`
 	procmail_domtrans(postfix_pipe_t)
 ')
@@ -407,6 +446,10 @@
 ')
 
 optional_policy(`
+	mta_manage_spool(postfix_pipe_t)
+')
+
+optional_policy(`
 	uucp_domtrans_uux(postfix_pipe_t)
 ')
 
@@ -443,8 +486,7 @@
 ')
 
 optional_policy(`
-	ppp_use_fds(postfix_postqueue_t)
-	ppp_sigchld(postfix_postqueue_t)
+	uucp_manage_spool(postfix_postdrop_t)
 ')
 
 #######################################
@@ -470,6 +512,15 @@
 init_sigchld_script(postfix_postqueue_t)
 init_use_script_fds(postfix_postqueue_t)
 
+optional_policy(`
+	cron_system_entry(postfix_postqueue_t, postfix_postqueue_exec_t)
+')
+
+optional_policy(`
+	ppp_use_fds(postfix_postqueue_t)
+	ppp_sigchld(postfix_postqueue_t)
+')
+
 ########################################
 #
 # Postfix qmgr local policy
@@ -564,6 +615,10 @@
 	sasl_connect(postfix_smtpd_t)
 ')
 
+optional_policy(`
+	dovecot_auth_stream_connect(postfix_smtpd_t)
+')
+
 ########################################
 #
 # Postfix virtual local policy
@@ -579,7 +634,7 @@
 files_tmp_filetrans(postfix_virtual_t, postfix_virtual_tmp_t, { file dir })
 
 # connect to master process
-stream_connect_pattern(postfix_virtual_t, postfix_public_t, postfix_public_t, postfix_master_t)
+stream_connect_pattern(postfix_virtual_t, { postfix_private_t postfix_public_t }, { postfix_private_t postfix_public_t }, postfix_master_t)
 
 corecmd_exec_shell(postfix_virtual_t)
 corecmd_exec_bin(postfix_virtual_t)
