From 97110105e93d75a92f041e29fc8d11542ee579e3 Mon Sep 17 00:00:00 2001 From: HuaxinLuGitee <1539327763@qq.com> Date: Tue, 2 Mar 2021 20:36:42 +0800 Subject: [PATCH] add backport patch for dovecot (cherry picked from commit 1c931678263cf426c22f5d7ad2e4d4a489a6084f) --- ...ort-Allow-dovecot-bind-to-smtp-ports.patch | 29 +++++++++++++++++++ selinux-policy.spec | 14 ++++----- 2 files changed, 36 insertions(+), 7 deletions(-) create mode 100644 backport-Allow-dovecot-bind-to-smtp-ports.patch diff --git a/backport-Allow-dovecot-bind-to-smtp-ports.patch b/backport-Allow-dovecot-bind-to-smtp-ports.patch new file mode 100644 index 0000000..6ba6751 --- /dev/null +++ b/backport-Allow-dovecot-bind-to-smtp-ports.patch @@ -0,0 +1,29 @@ +From f5c688321e04364bdfd030dd1412a7e5a4ecc6b6 Mon Sep 17 00:00:00 2001 +From: Zdenek Pytela +Date: Tue, 10 Nov 2020 18:04:49 +0100 +Subject: [PATCH] Allow dovecot bind to smtp ports + +When dovecot is configured to listen on submission ports +(tcp 465 or 587), it requires the name_bind permission to ports +labeled smtp_port_t. + +Resolves: rhbz#1881884 +--- + dovecot.te | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/policy/modules/contrib/dovecot.te b/policy/modules/contrib/dovecot.te +index 6cf4b72e9..0b140e932 100644 +--- a/policy/modules/contrib/dovecot.te ++++ b/policy/modules/contrib/dovecot.te +@@ -147,6 +147,7 @@ corenet_tcp_bind_mail_port(dovecot_t) + corenet_tcp_bind_pop_port(dovecot_t) + corenet_tcp_bind_lmtp_port(dovecot_t) + corenet_tcp_bind_sieve_port(dovecot_t) ++corenet_tcp_bind_smtp_port(dovecot_t) + corenet_tcp_connect_all_ports(dovecot_t) + corenet_tcp_connect_postgresql_port(dovecot_t) + corenet_sendrecv_pop_server_packets(dovecot_t) +-- +2.23.0 + diff --git a/selinux-policy.spec b/selinux-policy.spec index 1737360..a286053 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -12,7 +12,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.14.2 -Release: 63 +Release: 65 License: GPLv2+ URL: https://github.com/fedora-selinux/selinux-policy/ @@ -64,12 +64,9 @@ Patch11: add-avc-for-systemd-hostnamed-and-systemd-logind.patch Patch12: add-avc-for-systemd.patch Patch13: allow-systemd-to-mount-unlabeled-filesystemd.patch Patch14: add_userman_access_run_dir.patch -Patch15: allow-systemd-machined-create-userdbd-runtime-sock-file.patch -Patch16: allow-systemd_machined_t-delete-userdbd-runtime-sock.patch -Patch17: allow-systemd-hostnamed-and-logind-read-policy.patch -Patch18: add-firewalld-fc.patch -Patch19: add-allow-systemd-timedated-to-unlink-etc-link.patch -Patch20: add-avc-for-openEuler-1.patch +Patch15: add-allow-systemd-timedated-to-unlink-etc-link.patch +Patch16: add-avc-for-openEuler-1.patch +Patch17: backport-Allow-dovecot-bind-to-smtp-ports.patch BuildArch: noarch BuildRequires: python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc @@ -735,6 +732,9 @@ exit 0 %endif %changelog +* Tue Mar 2 2021 luhuaxin <1539327763@qq.com> - 3.14.2-65 +- add avc for allowing dovecot bind to smtp ports + * Sun Dec 13 2020 luhuaxin <1539327763@qq.com> - 3.14.2-64 - add avc for openEuler -- Gitee