Attachment 591175 Details for Bug 827568 – selinux dovecot imap alert details

selinux dovecot imap alert details

selinux.txt (text/plain), 14.59 KB, created by Roger Noble on 2012-06-12 12:00:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Roger Noble

Created: 2012-06-12 12:00:52 UTC

Size: 14.59 KB

patch

obsolete

>SELinux is preventing /usr/libexec/dovecot/imap from create access on the file dovecot-uidlist.lock.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that imap should be allowed create access on the dovecot-uidlist.lock file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep imap /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:dovecot_t:s0
>Target Context                system_u:object_r:mail_home_rw_t:s0
>Target Objects                dovecot-uidlist.lock [ file ]
>Source                        imap
>Source Path                   /usr/libexec/dovecot/imap
>Port                          <Unknown>
>Host                          flamsteed
>Source RPM Packages           dovecot-2.1.6-2.fc17.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.10.0-130.fc17.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     flamsteed
>Platform                      Linux flamsteed 3.4.0-1.fc17.x86_64 #1 SMP Sun Jun
>                              3 06:35:17 UTC 2012 x86_64 x86_64
>Alert Count                   3
>First Seen                    Mon 11 Jun 2012 11:11:44 PM BST
>Last Seen                     Tue 12 Jun 2012 09:35:50 AM BST
>Local ID                      cbc3ad89-8c79-42af-ac7b-d77e772e91dd
>
>Raw Audit Messages
>type=AVC msg=audit(1339490150.113:230): avc:  denied  { create } for  pid=7099 comm="imap" name="dovecot-uidlist.lock" scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1339490150.113:230): arch=x86_64 syscall=open success=yes exit=EEXIST a0=1d46400 a1=c2 a2=1b6 a3=8 items=0 ppid=897 pid=7099 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4294967295 comm=imap exe=/usr/libexec/dovecot/imap subj=system_u:system_r:dovecot_t:s0 key=(null)
>
>Hash: imap,dovecot_t,mail_home_rw_t,file,create
>
>audit2allowunable to open /sys/fs/selinux/policy:  Permission denied
>
>
>audit2allow -Runable to open /sys/fs/selinux/policy:  Permission denied
>
>
>-------------------------------------------------------------------------------------------------------
>
>
>SELinux is preventing /usr/libexec/dovecot/imap from unlink access on the file dovecot-uidlist.lock.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that imap should be allowed unlink access on the dovecot-uidlist.lock file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep imap /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:dovecot_t:s0
>Target Context                system_u:object_r:mail_home_rw_t:s0
>Target Objects                dovecot-uidlist.lock [ file ]
>Source                        imap
>Source Path                   /usr/libexec/dovecot/imap
>Port                          <Unknown>
>Host                          flamsteed
>Source RPM Packages           dovecot-2.1.6-2.fc17.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.10.0-130.fc17.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     flamsteed
>Platform                      Linux flamsteed 3.4.0-1.fc17.x86_64 #1 SMP Sun Jun
>                              3 06:35:17 UTC 2012 x86_64 x86_64
>Alert Count                   22
>First Seen                    Thu 07 Jun 2012 10:50:15 AM BST
>Last Seen                     Tue 12 Jun 2012 09:35:50 AM BST
>Local ID                      6bcd21ea-5688-41b7-b1e2-27a71ddecca6
>
>Raw Audit Messages
>type=AVC msg=audit(1339490150.114:231): avc:  denied  { unlink } for  pid=7099 comm="imap" name="dovecot-uidlist.lock" dev="dm-2" ino=35914064 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1339490150.114:231): arch=x86_64 syscall=unlink success=yes exit=0 a0=1db0060 a1=2 a2=1dbaa80 a3=69646c69614d2f6e items=0 ppid=897 pid=7099 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4294967295 comm=imap exe=/usr/libexec/dovecot/imap subj=system_u:system_r:dovecot_t:s0 key=(null)
>
>Hash: imap,dovecot_t,mail_home_rw_t,file,unlink
>
>audit2allowunable to open /sys/fs/selinux/policy:  Permission denied
>
>
>audit2allow -Runable to open /sys/fs/selinux/policy:  Permission denied
>
>
>-------------------------------------------------------------------------------------------------------
>
>
>SELinux is preventing /usr/libexec/dovecot/imap from write access on the file /home/rgn/Maildir/dovecot.index.log.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that imap should be allowed write access on the dovecot.index.log file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep imap /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:dovecot_t:s0
>Target Context                system_u:object_r:mail_home_rw_t:s0
>Target Objects                /home/rgn/Maildir/dovecot.index.log [ file ]
>Source                        imap
>Source Path                   /usr/libexec/dovecot/imap
>Port                          <Unknown>
>Host                          flamsteed
>Source RPM Packages           dovecot-2.1.6-2.fc17.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.10.0-130.fc17.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     flamsteed
>Platform                      Linux flamsteed 3.4.0-1.fc17.x86_64 #1 SMP Sun Jun
>                              3 06:35:17 UTC 2012 x86_64 x86_64
>Alert Count                   26
>First Seen                    Sun 10 Jun 2012 11:20:21 AM BST
>Last Seen                     Tue 12 Jun 2012 11:52:48 AM BST
>Local ID                      1e7f0a7e-2dd3-45ec-8585-e81dbca5813f
>
>Raw Audit Messages
>type=AVC msg=audit(1339498368.23:255): avc:  denied  { write } for  pid=7099 comm="imap" name="dovecot.index.log" dev="dm-2" ino=35929845 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1339498368.23:255): arch=x86_64 syscall=open success=yes exit=ECHILD a0=1d7bb30 a1=2 a2=7fff714dd1a0 a3=69646c69614d2f6e items=0 ppid=897 pid=7099 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4294967295 comm=imap exe=/usr/libexec/dovecot/imap subj=system_u:system_r:dovecot_t:s0 key=(null)
>
>Hash: imap,dovecot_t,mail_home_rw_t,file,write
>
>audit2allowunable to open /sys/fs/selinux/policy:  Permission denied
>
>
>audit2allow -Runable to open /sys/fs/selinux/policy:  Permission denied
>
>
>
>-------------------------------------------------------------------------------------------------------
>
>
>SELinux is preventing /usr/libexec/dovecot/imap from add_name access on the directory dovecot-uidlist.lock.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that imap should be allowed add_name access on the dovecot-uidlist.lock directory by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep imap /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:dovecot_t:s0
>Target Context                unconfined_u:object_r:mail_home_rw_t:s0
>Target Objects                dovecot-uidlist.lock [ dir ]
>Source                        imap
>Source Path                   /usr/libexec/dovecot/imap
>Port                          <Unknown>
>Host                          flamsteed
>Source RPM Packages           dovecot-2.1.6-2.fc17.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.10.0-130.fc17.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     flamsteed
>Platform                      Linux flamsteed 3.4.0-1.fc17.x86_64 #1 SMP Sun Jun
>                              3 06:35:17 UTC 2012 x86_64 x86_64
>Alert Count                   73
>First Seen                    Thu 07 Jun 2012 10:49:49 AM BST
>Last Seen                     Tue 12 Jun 2012 12:55:19 PM BST
>Local ID                      1f8abf7e-0f06-47e9-9e7d-cb1518295ba9
>
>Raw Audit Messages
>type=AVC msg=audit(1339502119.739:266): avc:  denied  { add_name } for  pid=6963 comm="imap" name="dovecot-uidlist.lock" scontext=system_u:system_r:dovecot_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir
>
>
>type=SYSCALL msg=audit(1339502119.739:266): arch=x86_64 syscall=open success=yes exit=ENOTBLK a0=1bef150 a1=c2 a2=1b6 a3=8 items=0 ppid=897 pid=6963 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4294967295 comm=imap exe=/usr/libexec/dovecot/imap subj=system_u:system_r:dovecot_t:s0 key=(null)
>
>Hash: imap,dovecot_t,mail_home_rw_t,dir,add_name
>
>audit2allowunable to open /sys/fs/selinux/policy:  Permission denied
>
>
>audit2allow -Runable to open /sys/fs/selinux/policy:  Permission denied
>
>
>-------------------------------------------------------------------------------------------------------
>
>
>SELinux is preventing /usr/libexec/dovecot/imap from remove_name access on the directory dovecot-uidlist.lock.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that imap should be allowed remove_name access on the dovecot-uidlist.lock directory by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep imap /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:dovecot_t:s0
>Target Context                unconfined_u:object_r:mail_home_rw_t:s0
>Target Objects                dovecot-uidlist.lock [ dir ]
>Source                        imap
>Source Path                   /usr/libexec/dovecot/imap
>Port                          <Unknown>
>Host                          flamsteed
>Source RPM Packages           dovecot-2.1.6-2.fc17.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.10.0-130.fc17.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     flamsteed
>Platform                      Linux flamsteed 3.4.0-1.fc17.x86_64 #1 SMP Sun Jun
>                              3 06:35:17 UTC 2012 x86_64 x86_64
>Alert Count                   8
>First Seen                    Mon 11 Jun 2012 11:11:03 PM BST
>Last Seen                     Tue 12 Jun 2012 12:55:19 PM BST
>Local ID                      da615e38-6341-473c-a197-c4ea8661d5cd
>
>Raw Audit Messages
>type=AVC msg=audit(1339502119.740:267): avc:  denied  { remove_name } for  pid=6963 comm="imap" name="dovecot-uidlist.lock" dev="dm-2" ino=35914064 scontext=system_u:system_r:dovecot_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir
>
>
>type=SYSCALL msg=audit(1339502119.740:267): arch=x86_64 syscall=unlink success=yes exit=0 a0=1c2eb00 a1=2 a2=1c23880 a3=69646c69614d2f6e items=0 ppid=897 pid=6963 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4294967295 comm=imap exe=/usr/libexec/dovecot/imap subj=system_u:system_r:dovecot_t:s0 key=(null)
>
>Hash: imap,dovecot_t,mail_home_rw_t,dir,remove_name
>
>audit2allowunable to open /sys/fs/selinux/policy:  Permission denied
>
>
>audit2allow -Runable to open /sys/fs/selinux/policy:  Permission denied
>
>
>
>-------------------------------------------------------------------------------------------------------
>
>
>SELinux is preventing /usr/libexec/dovecot/imap from rename access on the file dovecot-uidlist.tmp.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that imap should be allowed rename access on the dovecot-uidlist.tmp file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep imap /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:dovecot_t:s0
>Target Context                system_u:object_r:mail_home_rw_t:s0
>Target Objects                dovecot-uidlist.tmp [ file ]
>Source                        imap
>Source Path                   /usr/libexec/dovecot/imap
>Port                          <Unknown>
>Host                          flamsteed
>Source RPM Packages           dovecot-2.1.6-2.fc17.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.10.0-130.fc17.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     flamsteed
>Platform                      Linux flamsteed 3.4.0-1.fc17.x86_64 #1 SMP Sun Jun
>                              3 06:35:17 UTC 2012 x86_64 x86_64
>Alert Count                   5
>First Seen                    Mon 11 Jun 2012 11:12:04 PM BST
>Last Seen                     Tue 12 Jun 2012 12:48:48 PM BST
>Local ID                      93a232a4-e6ef-4dc5-914b-3253f35e0b0f
>
>Raw Audit Messages
>type=AVC msg=audit(1339501728.179:265): avc:  denied  { rename } for  pid=7099 comm="imap" name="dovecot-uidlist.tmp" dev="dm-2" ino=35930217 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1339501728.179:265): arch=x86_64 syscall=rename success=yes exit=0 a0=1d47290 a1=1d7c480 a2=3e575b0778 a3=1dbab20 items=0 ppid=897 pid=7099 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4294967295 comm=imap exe=/usr/libexec/dovecot/imap subj=system_u:system_r:dovecot_t:s0 key=(null)
>
>Hash: imap,dovecot_t,mail_home_rw_t,file,rename
>
>audit2allowunable to open /sys/fs/selinux/policy:  Permission denied
>
>
>audit2allow -Runable to open /sys/fs/selinux/policy:  Permission denied

Actions: View

Attachments on bug 827568: 588563 | 591175