--- nsaserefpolicy/policy/modules/services/mta.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/mta.fc	2008-08-14 13:53:54.000000000 -0400
@@ -11,6 +11,7 @@
 /usr/lib(64)?/sendmail	--	gen_context(system_u:object_r:sendmail_exec_t,s0)
 
 /usr/sbin/rmail		--	gen_context(system_u:object_r:sendmail_exec_t,s0)
+/bin/mail		--	gen_context(system_u:object_r:sendmail_exec_t,s0)
 /usr/sbin/sendmail\.postfix --	gen_context(system_u:object_r:sendmail_exec_t,s0)
 /usr/sbin/sendmail(\.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0)
 
@@ -21,7 +22,3 @@
 /var/spool/imap(/.*)?		gen_context(system_u:object_r:mail_spool_t,s0)
 /var/spool/(client)?mqueue(/.*)? gen_context(system_u:object_r:mqueue_spool_t,s0)
 /var/spool/mail(/.*)?		gen_context(system_u:object_r:mail_spool_t,s0)
-
-#ifdef(`postfix.te', `', `
-#/var/spool/postfix(/.*)?	gen_context(system_u:object_r:mail_spool_t,s0)
-#')
--- nsaserefpolicy/policy/modules/services/mta.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/mta.if	2008-08-14 13:53:54.000000000 -0400
@@ -133,6 +133,15 @@
 		sendmail_create_log($1_mail_t)
 	')
 
+	optional_policy(`
+		exim_read_log($1_mail_t)
+		exim_append_log($1_mail_t)
+		exim_manage_spool_files($1_mail_t)
+	')
+
+	optional_policy(`
+		uucp_manage_spool($1_mail_t)
+	')
 ')
 
 #######################################
@@ -199,7 +208,7 @@
 	userdom_use_user_terminals($1, mta_user_agent)
 	# Create dead.letter in user home directories.
 	userdom_manage_user_home_content_files($1, $1_mail_t)
-	userdom_user_home_dir_filetrans_user_home_content($1, $1_mail_t, file)
+	unprivuser_home_dir_filetrans_home_content($1_mail_t, file)
 	# for reading .forward - maybe we need a new type for it?
 	# also for delivering mail to maildir
 	userdom_manage_user_home_content_dirs($1, mailserver_delivery)
@@ -207,7 +216,7 @@
 	userdom_manage_user_home_content_symlinks($1, mailserver_delivery)
 	userdom_manage_user_home_content_pipes($1, mailserver_delivery)
 	userdom_manage_user_home_content_sockets($1, mailserver_delivery)
-	userdom_user_home_dir_filetrans_user_home_content($1, mailserver_delivery, { dir file lnk_file fifo_file sock_file })
+	unprivuser_home_dir_filetrans_home_content(mailserver_delivery, { dir file lnk_file fifo_file sock_file })
 	# Read user temporary files.
 	userdom_read_user_tmp_files($1, $1_mail_t)
 	userdom_dontaudit_append_user_tmp_files($1, $1_mail_t)
@@ -220,6 +229,11 @@
 		fs_manage_cifs_symlinks($1_mail_t)
 	')
 
+	tunable_policy(`use_nfs_home_dirs',`
+		fs_manage_nfs_files($1_mail_t)
+		fs_manage_nfs_symlinks($1_mail_t)
+	')
+
 	optional_policy(`
 		allow $1_mail_t self:capability dac_override;
 
@@ -311,6 +325,42 @@
 
 ########################################
 ## <summary>
+##	Make the specified type usable for a mta_send_mail.
+## </summary>
+## <param name="type">
+##	<summary>
+##	Type to be used as a mail client.
+##	</summary>
+## </param>
+#
+interface(`mta_mailclient',`
+	gen_require(`
+		attribute mailclient_exec_type;
+	')
+
+	typeattribute $1 mailclient_exec_type;
+')
+
+########################################
+## <summary>
+##	Make the specified type readable for a system_mail_t
+## </summary>
+## <param name="type">
+##	<summary>
+##	Type to be used as a mail client.
+##	</summary>
+## </param>
+#
+interface(`mta_mailcontent',`
+	gen_require(`
+		attribute mailcontent_type;
+	')
+
+	typeattribute $1 mailcontent_type;
+')
+
+########################################
+## <summary>
 ##	Modified mailserver interface for
 ##	sendmail daemon use.
 ## </summary>
@@ -385,11 +435,13 @@
 	allow $1 mail_spool_t:dir list_dir_perms;
 	create_files_pattern($1, mail_spool_t, mail_spool_t)
 	read_files_pattern($1, mail_spool_t, mail_spool_t)
+	append_files_pattern($1, mail_spool_t, mail_spool_t)
 	create_lnk_files_pattern($1, mail_spool_t, mail_spool_t)
 	read_lnk_files_pattern($1, mail_spool_t, mail_spool_t)
 
 	optional_policy(`
 		dovecot_manage_spool($1)
+		dovecot_domtrans_deliver($1)
 	')
 
 	optional_policy(`
@@ -424,6 +476,7 @@
 		# apache should set close-on-exec
 		apache_dontaudit_rw_stream_sockets($1)
 		apache_dontaudit_rw_sys_script_stream_sockets($1)
+		apache_append_log($1)
 	')
 ')
 
@@ -440,16 +493,13 @@
 interface(`mta_send_mail',`
 	gen_require(`
 		attribute mta_user_agent;
-		type system_mail_t, sendmail_exec_t;
+		type system_mail_t;
+		attribute mailclient_exec_type;
 	')
 
-	allow $1 sendmail_exec_t:lnk_file read_lnk_file_perms;
-	domain_auto_trans($1, sendmail_exec_t, system_mail_t)
-
-	allow $1 system_mail_t:fd use;
-	allow system_mail_t $1:fd use;
-	allow system_mail_t $1:fifo_file rw_file_perms;
-	allow system_mail_t $1:process sigchld;
+	allow $1 mailclient_exec_type:lnk_file read_lnk_file_perms;
+	domtrans_pattern($1, mailclient_exec_type, system_mail_t)
+	allow system_mail_t mailclient_exec_type:file entrypoint;
 
 	allow mta_user_agent $1:fd use;
 	allow mta_user_agent $1:process sigchld;
@@ -588,6 +638,25 @@
 	files_search_etc($1)
 	allow $1 etc_aliases_t:file { rw_file_perms setattr };
 ')
+########################################
+## <summary>
+##	manage mail aliases.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`mta_manage_aliases',`
+	gen_require(`
+		type etc_aliases_t;
+	')
+
+	files_search_etc($1)
+	allow $1 etc_aliases_t:file manage_file_perms;
+')
 
 #######################################
 ## <summary>
@@ -839,6 +908,25 @@
 
 ########################################
 ## <summary>
+##	read mail queue files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mta_read_queue',`
+	gen_require(`
+		type mqueue_spool_t;
+	')
+
+	files_search_spool($1)
+	read_files_pattern($1, mqueue_spool_t, mqueue_spool_t)
+')
+
+########################################
+## <summary>
 ##	Create, read, write, and delete
 ##	mail queue files.
 ## </summary>
--- nsaserefpolicy/policy/modules/services/mta.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/mta.te	2008-08-14 14:42:18.000000000 -0400
@@ -6,6 +6,8 @@
 # Declarations
 #
 
+attribute mailcontent_type;
+attribute mailclient_exec_type;
 attribute mta_user_agent;
 attribute mailserver_delivery;
 attribute mailserver_domain;
@@ -20,13 +22,14 @@
 files_config_file(etc_mail_t)
 
 type mqueue_spool_t;
-files_type(mqueue_spool_t)
+files_mountpoint(mqueue_spool_t)
 
 type mail_spool_t;
-files_type(mail_spool_t)
+files_mountpoint(mail_spool_t)
 
 type sendmail_exec_t;
 application_executable_file(sendmail_exec_t)
+mta_mailclient(sendmail_exec_t)
 
 mta_base_mail_template(system)
 role system_r types system_mail_t;
@@ -37,30 +40,48 @@
 #
 
 # newalias required this, not sure if it is needed in 'if' file
-allow system_mail_t self:capability { dac_override };
+allow system_mail_t self:capability { dac_override fowner };
+allow system_mail_t self:fifo_file rw_fifo_file_perms;
+
+can_exec(system_mail_t, mailclient_exec_type)
 
 read_files_pattern(system_mail_t, etc_mail_t, etc_mail_t)
+read_files_pattern(system_mail_t, mailcontent_type, mailcontent_type)
+
+files_read_all_tmp_files(system_mail_t)
 
 kernel_read_system_state(system_mail_t)
 kernel_read_network_state(system_mail_t)
 
+dev_read_sysfs(system_mail_t)
 dev_read_rand(system_mail_t)
 dev_read_urand(system_mail_t)
 
+fs_rw_anon_inodefs_files(system_mail_t)
+fs_list_inotifyfs(system_mail_t)
+
+selinux_getattr_fs(system_mail_t)
+
 init_use_script_ptys(system_mail_t)
 
+logging_append_all_logs(system_mail_t)
+
+files_dontaudit_search_home(system_mail_t)
 sysadm_use_terms(system_mail_t)
 sysadm_dontaudit_search_home_dirs(system_mail_t)
+userdom_dontaudit_search_all_users_home_content(system_mail_t)
 
 optional_policy(`
 	apache_read_squirrelmail_data(system_mail_t)
 	apache_append_squirrelmail_data(system_mail_t)
+	apache_search_bugzilla_dirs(system_mail_t)
 
 	# apache should set close-on-exec
 	apache_dontaudit_append_log(system_mail_t)
 	apache_dontaudit_rw_stream_sockets(system_mail_t)
 	apache_dontaudit_rw_tcp_sockets(system_mail_t)
 	apache_dontaudit_rw_sys_script_stream_sockets(system_mail_t)
+	apache_dontaudit_rw_bugzilla_script_stream_sockets(system_mail_t)
 ')
 
 optional_policy(`
@@ -73,7 +94,17 @@
 
 optional_policy(`
 	cron_read_system_job_tmp_files(system_mail_t)
+	cron_read_tmp_files(system_mail_t)
 	cron_dontaudit_write_pipes(system_mail_t)
+	cron_dontaudit_write_system_job_tmp_files(system_mail_t)
+	cron_rw_system_stream_sockets(system_mail_t)
+')
+
+optional_policy(`
+	courier_read_config(system_mail_t)
+	courier_manage_spool_dirs(system_mail_t)
+	courier_manage_spool_files(system_mail_t)
+	courier_rw_pipes(system_mail_t)
 ')
 
 optional_policy(`
@@ -81,6 +112,11 @@
 ')
 
 optional_policy(`
+	exim_domtrans(system_mail_t)
+	exim_manage_log(system_mail_t)
+')
+
+optional_policy(`
 	logrotate_read_tmp_files(system_mail_t)
 ')
 
@@ -113,10 +149,6 @@
 		# compatability for old default main.cf
 		postfix_config_filetrans(system_mail_t, etc_aliases_t, { dir file lnk_file sock_file fifo_file })
 	')
-
-	optional_policy(`
-		cron_rw_tcp_sockets(system_mail_t)
-	')
 ')
 
 optional_policy(`
@@ -136,11 +168,40 @@
 ')
 
 optional_policy(`
+	clamav_stream_connect(system_mail_t)
+	clamav_append_log(system_mail_t)
+')
+
+optional_policy(`
+	fail2ban_append_log(system_mail_t)
+')
+
+optional_policy(`
+	spamd_stream_connect(system_mail_t)
+')
+
+optional_policy(`
 	smartmon_read_tmp_files(system_mail_t)
 ')
 
-# should break this up among sections:
+read_files_pattern(mailserver_delivery, system_mail_tmp_t, system_mail_tmp_t)
+
+init_stream_connect_script(mailserver_delivery)
+init_rw_script_stream_sockets(mailserver_delivery)
+
+tunable_policy(`use_samba_home_dirs',`
+	fs_manage_cifs_dirs(mailserver_delivery)
+	fs_manage_cifs_files(mailserver_delivery)
+	fs_manage_cifs_symlinks(mailserver_delivery)
+')
 
+tunable_policy(`use_nfs_home_dirs',`
+	fs_manage_nfs_dirs(mailserver_delivery)
+	fs_manage_nfs_files(mailserver_delivery)
+	fs_manage_nfs_symlinks(mailserver_delivery)
+')
+
+# should break this up among sections:
 optional_policy(`
 	# why is mail delivered to a directory of type arpwatch_data_t?
 	arpwatch_search_data(mailserver_delivery)
