# Last Modified: Sat Apr  5 03:09:58 2008
#include <tunables/global>
/usr/sbin/dovecot {
  #include <abstractions/authentication>
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/ssl_certs>
  #include <abstractions/wutmp>

  capability chown,
  capability setgid,
  capability setuid,
  capability sys_chroot,

  /etc/dovecot/* r,
  /etc/mtab r,
  /etc/pamusb.conf r,
  /etc/ssl/private/ssl-cert-snakeoil.key r,
  /usr/lib/dovecot/dovecot-auth ixr,
  /usr/lib/dovecot/imap ixr,
  /usr/lib/dovecot/imap-login ixr,
  /usr/lib/dovecot/ssl-build-param ixr,
  /usr/sbin/dovecot mr,
  /var/lib/dovecot/ rw,
  /var/lib/dovecot/** rwk,
  /var/run/dovecot/ rw,
  /var/run/dovecot/** rw,
  /var/run/dovecot/*/ rw,
  /var/run/utmp krw,
  @{HOME}/Mail/ rw,
  @{HOME}/Mail/** klrw,
  @{PROC}/*/mounts r,
}