--- nsaserefpolicy/policy/modules/services/dovecot.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/dovecot.fc	2008-08-14 13:53:54.000000000 -0400
@@ -17,23 +17,24 @@
 
 ifdef(`distro_debian', `
 /usr/lib/dovecot/dovecot-auth 	--	gen_context(system_u:object_r:dovecot_auth_exec_t,s0)
+/usr/lib/dovecot/deliver --	gen_context(system_u:object_r:dovecot_deliver_exec_t,s0)
 ')
 
 ifdef(`distro_redhat', `
 /usr/libexec/dovecot/dovecot-auth --	gen_context(system_u:object_r:dovecot_auth_exec_t,s0)
+/usr/libexec/dovecot/deliver --	gen_context(system_u:object_r:dovecot_deliver_exec_t,s0)
 ')
 
 #
 # /var
 #
 /var/run/dovecot(-login)?(/.*)?		gen_context(system_u:object_r:dovecot_var_run_t,s0)
-# this is a hard link to /var/lib/dovecot/ssl-parameters.dat
-/var/run/dovecot/login/ssl-parameters.dat	gen_context(system_u:object_r:dovecot_var_lib_t,s0)
+/var/run/dovecot/login/ssl-parameters.dat -- gen_context(system_u:object_r:dovecot_var_lib_t,s0)
 
 /var/lib/dovecot(/.*)?			gen_context(system_u:object_r:dovecot_var_lib_t,s0)
 
-/var/spool/dovecot(/.*)?		gen_context(system_u:object_r:dovecot_spool_t,s0)
-
-
+/var/log/dovecot\.log.*			gen_context(system_u:object_r:dovecot_var_log_t,s0)
 
+/var/spool/dovecot(/.*)?		gen_context(system_u:object_r:dovecot_spool_t,s0)
 
+/etc/rc.d/init.d/dovecot	--	gen_context(system_u:object_r:dovecot_script_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/dovecot.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/dovecot.if	2008-08-14 13:53:54.000000000 -0400
@@ -21,7 +21,46 @@
 
 ########################################
 ## <summary>
-##      Do not audit attempts to delete dovecot lib files.
+##	Connect to dovecot auth unix domain stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`dovecot_auth_stream_connect',`
+	gen_require(`
+		type dovecot_auth_t, dovecot_var_run_t;
+	')
+
+	allow $1 dovecot_var_run_t:dir search;
+	allow $1 dovecot_var_run_t:sock_file write;
+	allow $1 dovecot_auth_t:unix_stream_socket connectto;
+')
+
+########################################
+## <summary>
+##	Execute dovecot_deliver in the dovecot_deliver domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dovecot_domtrans_deliver',`
+	gen_require(`
+		type dovecot_deliver_t, dovecot_deliver_exec_t;
+	')
+
+	domtrans_pattern($1, dovecot_deliver_exec_t, dovecot_deliver_t)
+')
+
+#######################################
+## <summary>
+##      Do not audit attempts to d`elete dovecot lib files.
 ## </summary>
 ## <param name="domain">
 ##      <summary>
@@ -36,3 +75,89 @@
 
 	dontaudit $1 dovecot_var_lib_t:file unlink;
 ')
+
+########################################
+## <summary>
+##	Execute dovecot server in the dovecot domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`dovecot_script_domtrans',`
+	gen_require(`
+		type dovecot_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, dovecot_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an dovecot environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the dovecot domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`dovecot_admin',`
+	gen_require(`
+		type dovecot_t;
+		type dovecot_script_exec_t;
+		type dovecot_etc_t;
+		type dovecot_log_t;
+		type dovecot_spool_t;
+		type dovecot_var_lib_t;
+		type dovecot_var_run_t;
+
+		type dovecot_cert_t;
+		type dovecot_passwd_t;
+	')
+
+	allow $1 dovecot_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, dovecot_t, dovecot_t)
+	        
+	# Allow dovecot_t to restart the apache service
+	dovecot_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 dovecot_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_etc($1)
+        admin_pattern($1, dovecot_etc_t)
+
+	logging_list_logs($1)
+        admin_pattern($1, dovecot_log_t)
+
+	files_list_spool($1)
+	admin_pattern($1, dovecot_spool_t)
+
+	files_list_var_lib($1)
+        admin_pattern($1, dovecot_var_lib_t)
+
+	files_list_pids($1)
+        admin_pattern($1, dovecot_var_run_t)
+
+        admin_pattern($1, dovecot_cert_t)
+
+        admin_pattern($1, dovecot_passwd_t)
+')
+
+
--- nsaserefpolicy/policy/modules/services/dovecot.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/dovecot.te	2008-08-14 13:53:54.000000000 -0400
@@ -15,6 +15,12 @@
 domain_entry_file(dovecot_auth_t, dovecot_auth_exec_t)
 role system_r types dovecot_auth_t;
 
+type dovecot_deliver_t;
+type dovecot_deliver_exec_t;
+domain_type(dovecot_deliver_t)
+domain_entry_file(dovecot_deliver_t, dovecot_deliver_exec_t)
+role system_r types dovecot_deliver_t;
+
 type dovecot_cert_t;
 files_type(dovecot_cert_t)
 
@@ -31,9 +37,18 @@
 type dovecot_var_lib_t;
 files_type(dovecot_var_lib_t) 
 
+type dovecot_var_log_t;
+logging_log_file(dovecot_var_log_t)
+
 type dovecot_var_run_t;
 files_pid_file(dovecot_var_run_t)
 
+type dovecot_auth_tmp_t;
+files_tmp_file(dovecot_auth_tmp_t)
+
+type dovecot_script_exec_t;
+init_script_type(dovecot_script_exec_t)
+
 ########################################
 #
 # dovecot local policy
@@ -85,6 +100,7 @@
 dev_read_urand(dovecot_t)
 
 fs_getattr_all_fs(dovecot_t)
+fs_getattr_all_dirs(dovecot_t)
 fs_search_auto_mountpoints(dovecot_t)
 fs_list_inotifyfs(dovecot_t)
 
@@ -98,7 +114,7 @@
 files_dontaudit_list_default(dovecot_t)
 # Dovecot now has quota support and it uses getmntent() to find the mountpoints.
 files_read_etc_runtime_files(dovecot_t)
-files_getattr_all_mountpoints(dovecot_t)
+files_search_all_mountpoints(dovecot_t)
 
 init_getattr_utmp(dovecot_t)
 
@@ -120,7 +136,7 @@
 sysadm_dontaudit_search_home_dirs(dovecot_t)
 
 optional_policy(`
-	kerberos_use(dovecot_t)
+	kerberos_keytab_template(dovecot, dovecot_t)
 ')
 
 optional_policy(`
@@ -140,25 +156,39 @@
 # dovecot auth local policy
 #
 
-allow dovecot_auth_t self:capability { setgid setuid };
+allow dovecot_auth_t self:capability { chown dac_override setgid setuid };
 allow dovecot_auth_t self:process signal_perms;
 allow dovecot_auth_t self:fifo_file rw_fifo_file_perms;
 allow dovecot_auth_t self:unix_dgram_socket create_socket_perms;
 allow dovecot_auth_t self:unix_stream_socket create_stream_socket_perms;
 
-allow dovecot_auth_t dovecot_t:unix_stream_socket { getattr accept read write ioctl };
+allow dovecot_auth_t dovecot_t:unix_stream_socket { getattr accept read write ioctl connectto };
 
 allow dovecot_auth_t dovecot_passwd_t:file { getattr read };
 
+manage_dirs_pattern(dovecot_auth_t, dovecot_auth_tmp_t, dovecot_auth_tmp_t)
+manage_files_pattern(dovecot_auth_t, dovecot_auth_tmp_t, dovecot_auth_tmp_t)
+files_tmp_filetrans(dovecot_auth_t, dovecot_auth_tmp_t, { file dir })
+
+# log files
+manage_files_pattern(dovecot_t, dovecot_var_log_t, dovecot_var_log_t)
+logging_log_filetrans(dovecot_t, dovecot_var_log_t, file)
+
 # Allow dovecot to create and read SSL parameters file
 manage_files_pattern(dovecot_t, dovecot_var_lib_t, dovecot_var_lib_t)
 files_search_var_lib(dovecot_t)
+files_read_var_symlinks(dovecot_t)
 
 allow dovecot_auth_t dovecot_var_run_t:dir list_dir_perms;
+manage_sock_files_pattern(dovecot_auth_t, dovecot_var_run_t, dovecot_var_run_t)
+dovecot_auth_stream_connect(dovecot_auth_t)
 
 kernel_read_all_sysctls(dovecot_auth_t)
 kernel_read_system_state(dovecot_auth_t)
 
+logging_send_audit_msgs(dovecot_auth_t)
+logging_send_syslog_msg(dovecot_auth_t)
+
 dev_read_urand(dovecot_auth_t)
 
 auth_domtrans_chk_passwd(dovecot_auth_t)
@@ -167,6 +197,7 @@
 files_read_etc_files(dovecot_auth_t)
 files_read_etc_runtime_files(dovecot_auth_t)
 files_search_pids(dovecot_auth_t)
+files_read_usr_files(dovecot_auth_t)
 files_read_usr_symlinks(dovecot_auth_t)
 files_search_tmp(dovecot_auth_t)
 files_read_var_lib_files(dovecot_t)
@@ -185,5 +216,53 @@
 ')
 
 optional_policy(`
-	logging_send_syslog_msg(dovecot_auth_t)
+	mysql_search_db(dovecot_auth_t)
+	mysql_stream_connect(dovecot_auth_t)
+')
+
+optional_policy(`
+	nis_authenticate(dovecot_auth_t)
+')
+
+optional_policy(`
+	postfix_manage_private_sockets(dovecot_auth_t)
+	postfix_search_spool(dovecot_auth_t)
+')
+
+# for gssapi (kerberos)
+userdom_list_unpriv_users_tmp(dovecot_auth_t) 
+userdom_read_unpriv_users_tmp_files(dovecot_auth_t) 
+userdom_read_unpriv_users_tmp_symlinks(dovecot_auth_t) 
+
+########################################
+#
+# dovecot deliver local policy
+#
+allow dovecot_deliver_t self:unix_dgram_socket create_socket_perms;
+
+allow dovecot_deliver_t dovecot_etc_t:file read_file_perms;
+allow dovecot_deliver_t dovecot_var_run_t:dir list_dir_perms;
+
+kernel_read_all_sysctls(dovecot_deliver_t)
+kernel_read_system_state(dovecot_deliver_t)
+
+files_read_etc_files(dovecot_deliver_t)
+files_read_etc_runtime_files(dovecot_deliver_t)
+
+auth_use_nsswitch(dovecot_deliver_t)
+
+libs_use_ld_so(dovecot_deliver_t)
+libs_use_shared_libs(dovecot_deliver_t)
+
+logging_send_syslog_msg(dovecot_deliver_t)
+
+miscfiles_read_localization(dovecot_deliver_t)
+
+dovecot_auth_stream_connect(dovecot_deliver_t)
+
+userdom_priveleged_home_dir_manager(dovecot_deliver_t)
+
+optional_policy(`
+	mta_manage_spool(dovecot_deliver_t)
 ')
+
