Email - postfix-local.te (SELinux module)

module postfix-local 1.0;

require {
        type var_t;
        type var_log_t;
        type system_mail_t;
        type postfix_spool_t;
        type postfix_pipe_t;
        type logrotate_t;
        type user_home_dir_t;
        type gpg_exec_t;
        type gpg_agent_exec_t;
        class dir { create read add_name remove_name write rmdir };
        class file { create execute execute_no_trans getattr link lock open read rename setattr unlink write append };
}

# The filter script, started by pipe(8): run gpg and gpg-agent, create and
# remove working and archive directories and files under the Postfix spool,
# write its own log (labelled var_log_t, see below), touch the home directory
# of the filter account where GnuPG keeps its keyring.
#============= postfix_pipe_t ==============
allow postfix_pipe_t gpg_agent_exec_t:file { execute read };
allow postfix_pipe_t gpg_exec_t:file { execute execute_no_trans open read };
allow postfix_pipe_t postfix_spool_t:dir { create add_name remove_name write rmdir };
allow postfix_pipe_t postfix_spool_t:file { create open write read getattr unlink };
allow postfix_pipe_t var_t:dir { add_name remove_name write };
allow postfix_pipe_t var_log_t:file { create getattr link lock open read rename setattr unlink write append };
allow postfix_pipe_t user_home_dir_t:dir write;

# The sendmail command, called by the filter to put the message back into
# Postfix, reads the message file from the spool.
#============= system_mail_t ==============
allow system_mail_t postfix_spool_t:file { getattr read };

# logrotate rotates the filter log, which lives under the Postfix spool.
#============= logrotate_t ==============
allow logrotate_t postfix_spool_t:dir read;
allow logrotate_t postfix_spool_t:file { create getattr link lock open read rename setattr unlink write };

$ semanage fcontext -a -e /var/log /var/spool/postfix/bash-postfix-encrypt-filter/log
$ restorecon -R -v /var/spool/postfix/bash-postfix-encrypt-filter/log/