Index: refpolicy-2.20260721/policy/modules/services/mta.if
===================================================================
--- refpolicy-2.20260721.orig/policy/modules/services/mta.if
+++ refpolicy-2.20260721/policy/modules/services/mta.if
@@ -89,10 +89,14 @@ template(`mta_role',`
 	gen_require(`
 		attribute mta_user_agent;
 		attribute_role user_mail_roles;
-		type user_mail_t, sendmail_exec_t, mail_home_t;
+		type sendmail_exec_t, mail_home_t;
 		type user_mail_tmp_t, mail_home_rw_t;
 	')
 
+	mta_base_mail_template($1)
+	role $4 types $1_mail_t;
+	userdom_use_inherited_user_terminals($1_mail_t)
+
 	roleattribute $4 user_mail_roles;
 
 	# this is something i need to fix
@@ -100,24 +104,34 @@ template(`mta_role',`
 	# will role attribute work?
 	role $4 types mta_user_agent;
 
-	domtrans_pattern($3, sendmail_exec_t, user_mail_t)
+	dev_read_sysfs($1_mail_t)
+
+	domtrans_pattern($3, sendmail_exec_t, $1_mail_t)
 	allow $3 sendmail_exec_t:lnk_file read_lnk_file_perms;
 
-	allow $3 { user_mail_t mta_user_agent }:process { ptrace signal_perms };
-	ps_process_pattern($3, { user_mail_t mta_user_agent })
+	allow $3 { $1_mail_t mta_user_agent }:process { ptrace signal_perms };
+	ps_process_pattern($3, { $1_mail_t mta_user_agent })
 
 	allow $2 mail_home_t:file { manage_file_perms relabel_file_perms };
+	manage_files_pattern($1_mail_t, mail_home_t, mail_home_t)
+
 	userdom_user_home_dir_filetrans($2, mail_home_t, file, ".esmtp_queue")
 	userdom_user_home_dir_filetrans($2, mail_home_t, file, ".forward")
 	userdom_user_home_dir_filetrans($2, mail_home_t, file, ".mailrc")
 	userdom_user_home_dir_filetrans($2, mail_home_t, file, "dead.letter")
 
+	userdom_user_home_dir_filetrans($1_mail_t, mail_home_t, file, ".esmtp_queue")
+	userdom_user_home_dir_filetrans($1_mail_t, mail_home_t, file, ".forward")
+	userdom_user_home_dir_filetrans($1_mail_t, mail_home_t, file, ".mailrc")
+	userdom_user_home_dir_filetrans($1_mail_t, mail_home_t, file, "dead.letter")
+
 	allow $2 mail_home_rw_t:dir { manage_dir_perms relabel_dir_perms };
 	allow $2 mail_home_rw_t:file { manage_file_perms relabel_file_perms };
 	allow $2 mail_home_rw_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
 	userdom_user_home_dir_filetrans($2, mail_home_rw_t, dir, "Maildir")
 	userdom_user_home_dir_filetrans($2, mail_home_rw_t, dir, ".maildir")
 
+
 	allow $2 user_mail_tmp_t:dir { manage_dir_perms relabel_dir_perms };
 	allow $2 user_mail_tmp_t:file { manage_file_perms relabel_file_perms };
 
@@ -130,8 +144,54 @@ template(`mta_role',`
 	')
 
 	optional_policy(`
-		systemd_user_app_status($1, user_mail_t)
+		allow $1_mail_t self:capability dac_override;
+
+		userdom_rw_user_tmp_files($1_mail_t)
+
+		postfix_read_config($1_mail_t)
+		postfix_list_spool($1_mail_t)
 	')
+
+	optional_policy(`
+		systemd_user_app_status($1, $1_mail_t)
+	')
+')
+
+########################################
+## <summary>
+##	Role access for mta admin
+## </summary>
+## <param name="role_prefix">
+##	<summary>
+##	The prefix of the user role (e.g., user
+##	is the prefix for user_r).
+##	</summary>
+## </param>
+## <param name="user_domain">
+##	<summary>
+##	User domain for the role.
+##	</summary>
+## </param>
+## <param name="user_exec_domain">
+##	<summary>
+##	User exec domain for execute and transition access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access
+##	</summary>
+## </param>
+#
+template(`mta_admin_role',`
+	gen_require(`
+		type etc_aliases_t;
+	')
+
+	mta_role($1, $2, $3, $4)
+
+	files_etc_filetrans($1_mail_t, etc_aliases_t, file)
+	allow $1_mail_t etc_aliases_t:file manage_file_perms;
 ')
 
 ########################################
Index: refpolicy-2.20260721/policy/modules/services/mta.te
===================================================================
--- refpolicy-2.20260721.orig/policy/modules/services/mta.te
+++ refpolicy-2.20260721/policy/modules/services/mta.te
@@ -41,16 +41,6 @@ mta_agent_executable(sendmail_exec_t)
 mta_base_mail_template(system)
 role system_r types system_mail_t;
 
-mta_base_mail_template(user)
-userdom_user_application_type(user_mail_t)
-role user_mail_roles types user_mail_t;
-
-mta_base_mail_template(admin)
-userdom_user_application_type(admin_mail_t)
-role admin_mail_roles types admin_mail_t;
-
-userdom_user_tmp_file(user_mail_tmp_t)
-
 ########################################
 #
 # Common base mail policy
@@ -179,12 +169,6 @@ read_files_pattern(system_mail_t, etc_ma
 
 read_files_pattern(system_mail_t, mailcontent_type, mailcontent_type)
 
-allow system_mail_t mail_home_t:file manage_file_perms;
-userdom_user_home_dir_filetrans(system_mail_t, mail_home_t, file, ".esmtp_queue")
-userdom_user_home_dir_filetrans(system_mail_t, mail_home_t, file, ".forward")
-userdom_user_home_dir_filetrans(system_mail_t, mail_home_t, file, ".mailrc")
-userdom_user_home_dir_filetrans(system_mail_t, mail_home_t, file, "dead.letter")
-
 allow system_mail_t user_mail_domain:dir list_dir_perms;
 allow system_mail_t user_mail_domain:file read_file_perms;
 allow system_mail_t user_mail_domain:lnk_file read_lnk_file_perms;
@@ -192,7 +176,6 @@ allow system_mail_t user_mail_domain:lnk
 corecmd_exec_shell(system_mail_t)
 
 dev_read_rand(system_mail_t)
-dev_read_sysfs(system_mail_t)
 
 fs_rw_anon_inodefs_files(system_mail_t)
 
@@ -204,8 +187,6 @@ init_use_script_ptys(system_mail_t)
 init_use_fds(system_mail_t)
 init_rw_stream_sockets(system_mail_t)
 
-userdom_use_user_terminals(system_mail_t)
-
 optional_policy(`
 	apt_use_fds(system_mail_t)
 	apt_use_ptys(system_mail_t)
@@ -321,7 +302,7 @@ optional_policy(`
 # MTA user agent local policy
 #
 
-userdom_use_user_terminals(mta_user_agent)
+userdom_use_inherited_user_terminals(mta_user_agent)
 
 optional_policy(`
 	apache_append_log(mta_user_agent)
@@ -410,54 +391,3 @@ optional_policy(`
 optional_policy(`
 	uucp_domtrans_uux(mailserver_delivery)
 ')
-
-########################################
-#
-# User local policy
-#
-
-manage_files_pattern(user_mail_t, mail_home_t, mail_home_t)
-userdom_user_home_dir_filetrans(user_mail_t, mail_home_t, file, ".esmtp_queue")
-userdom_user_home_dir_filetrans(user_mail_t, mail_home_t, file, ".forward")
-userdom_user_home_dir_filetrans(user_mail_t, mail_home_t, file, ".mailrc")
-userdom_user_home_dir_filetrans(user_mail_t, mail_home_t, file, "dead.letter")
-
-dev_read_sysfs(user_mail_t)
-
-userdom_use_user_terminals(user_mail_t)
-
-optional_policy(`
-	allow user_mail_t self:capability dac_override;
-
-	userdom_rw_user_tmp_files(user_mail_t)
-
-	postfix_read_config(user_mail_t)
-	postfix_list_spool(user_mail_t)
-')
-
-########################################
-#
-# Admin local policy
-#
-
-manage_files_pattern(admin_mail_t, mail_home_t, mail_home_t)
-userdom_user_home_dir_filetrans(admin_mail_t, mail_home_t, file, ".esmtp_queue")
-userdom_user_home_dir_filetrans(admin_mail_t, mail_home_t, file, ".forward")
-userdom_user_home_dir_filetrans(admin_mail_t, mail_home_t, file, ".mailrc")
-userdom_user_home_dir_filetrans(admin_mail_t, mail_home_t, file, "dead.letter")
-
-dev_read_sysfs(admin_mail_t)
-
-userdom_use_user_terminals(admin_mail_t)
-
-files_etc_filetrans(admin_mail_t, etc_aliases_t, file)
-allow admin_mail_t etc_aliases_t:file manage_file_perms;
-
-optional_policy(`
-	allow admin_mail_t self:capability dac_override;
-
-	userdom_rw_user_tmp_files(admin_mail_t)
-
-	postfix_read_config(admin_mail_t)
-	postfix_list_spool(admin_mail_t)
-')
Index: refpolicy-2.20260721/policy/modules/system/libraries.fc
===================================================================
--- refpolicy-2.20260721.orig/policy/modules/system/libraries.fc
+++ refpolicy-2.20260721/policy/modules/system/libraries.fc
@@ -116,6 +116,7 @@ ifdef(`distro_debian',`
 ')
 
 /usr/lib/postfix/lib.*so.*		--	gen_context(system_u:object_r:lib_t,s0)
+/usr/lib/postfix/postfix.*so		--	gen_context(system_u:object_r:lib_t,s0)
 /usr/lib/altivec/libavcodec\.so(\.[^/]*)* --	gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib/cedega/.+\.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib/dovecot/(.*/)?lib.*\.so.*      --      gen_context(system_u:object_r:lib_t,s0)
Index: refpolicy-2.20260721/policy/modules/roles/sysadm.te
===================================================================
--- refpolicy-2.20260721.orig/policy/modules/roles/sysadm.te
+++ refpolicy-2.20260721/policy/modules/roles/sysadm.te
@@ -716,7 +716,7 @@ optional_policy(`
 ')
 
 optional_policy(`
-	mta_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
+	mta_admin_role(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
 ')
 
 optional_policy(`
Index: refpolicy-2.20260721/policy/modules/services/postfix.te
===================================================================
--- refpolicy-2.20260721.orig/policy/modules/services/postfix.te
+++ refpolicy-2.20260721/policy/modules/services/postfix.te
@@ -528,6 +528,9 @@ kernel_dontaudit_read_system_state(postf
 
 dev_read_urand(postfix_map_t)
 
+domain_use_interactive_fds(postfix_map_t)
+userdom_use_inherited_user_terminals(postfix_map_t)
+
 corenet_all_recvfrom_netlabel(postfix_map_t)
 corenet_tcp_sendrecv_generic_if(postfix_map_t)
 corenet_tcp_sendrecv_generic_node(postfix_map_t)
Index: refpolicy-2.20260721/policy/modules/system/unconfined.te
===================================================================
--- refpolicy-2.20260721.orig/policy/modules/system/unconfined.te
+++ refpolicy-2.20260721/policy/modules/system/unconfined.te
@@ -167,7 +167,7 @@ optional_policy(`
 ')
 
 optional_policy(`
-	mta_role(unconfined, unconfined_t, unconfined_application_exec_domain, unconfined_r)
+	mta_admin_role(unconfined, unconfined_t, unconfined_application_exec_domain, unconfined_r)
 ')
 
 optional_policy(`
