Security-Enhanced Linux secures the spamd processes via flexible mandatory access control.
If you want to allow user spamassassin clients to use the network, you must turn on the spamassassin_can_network boolean.
setsebool -P spamassassin_can_network 1
If you want to allow spamd to read/write user home directories, you must turn on the spamd_enable_home_dirs boolean.
setsebool -P spamd_enable_home_dirs 1
If you want to allow http daemon to check spam, you must turn on the httpd_can_check_spam boolean.
setsebool -P httpd_can_check_spam 1
If you want to allow users to resolve user passwd entries directly from ldap rather then using a sssd serve for the spamc_t, spamd_update_t, spamd_t, spamass_milter_t, you must turn on the authlogin_nsswitch_use_ldap boolean.
setsebool -P authlogin_nsswitch_use_ldap 1
If you want to allow confined applications to run with kerberos for the spamc_t, spamd_update_t, spamd_t, spamass_milter_t, you must turn on the kerberos_enabled boolean.
setsebool -P kerberos_enabled 1
You can see the context of a file using the -Z option to lsP Policy governs the access confined processes have to these files. SELinux spamd policy is very flexible allowing users to setup their spamd processes in as secure a method as possible.
The following file types are defined for spamd:
spamd_compiled_t
- Set files with the spamd_compiled_t type, if you want to treat the files as spamd compiled data.
spamd_etc_t
- Set files with the spamd_etc_t type, if you want to store spamd files in the /etc directories.
spamd_exec_t
- Set files with the spamd_exec_t type, if you want to transition an executable to the spamd_t domain.
spamd_initrc_exec_t
- Set files with the spamd_initrc_exec_t type, if you want to transition an executable to the spamd_initrc_t domain.
spamd_log_t
- Set files with the spamd_log_t type, if you want to treat the data as spamd log data, usually stored under the /var/log directory.
spamd_spool_t
- Set files with the spamd_spool_t type, if you want to store the spamd files under the /var/spool directory.
spamd_tmp_t
- Set files with the spamd_tmp_t type, if you want to store spamd temporary files in the /tmp directories.
spamd_update_exec_t
- Set files with the spamd_update_exec_t type, if you want to transition an executable to the spamd_update_t domain.
spamd_var_lib_t
- Set files with the spamd_var_lib_t type, if you want to store the spamd files under the /var/lib directory.
spamd_var_run_t
- Set files with the spamd_var_run_t type, if you want to store the spamd files under the /run directory.