Bug 1213740
| Summary: | pcp: postfix pmda needs access to /var/log/maillog | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Miloš Prchlík <mprchlik> | |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | |
| Status: | CLOSED ERRATA | QA Contact: | Patrik Kis <pkis> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 7.1 | CC: | lvrabec, mgrepl, mmalik, pkis, plautrba, pvrabec, ssekidde | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | selinux-policy-3.13.1-35.el7 | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1232189 (view as bug list) | Environment: | ||
| Last Closed: | 2015-11-19 10:32:54 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1232189 | |||
commit dead79147829cba0c76720805eb5cfed8ef29856
Author: Lukas Vrabec <lvrabec>
Date: Thu Jul 23 15:23:36 2015 +0200
Added Booleans: pcp_read_generic_logs.
Resolves: #1213740
commit c435cebc1293d3ae0b5acaff1e04909079ee384a
Author: Lukas Vrabec <lvrabec>
Date: Thu Jul 23 14:37:47 2015 +0200
Allow pcp_pmcd daemon to read postfix config files.
Allow pcp_pmcd daemon to search postfix spool dirs.
Resolves: #1213740
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2300.html |
Description of problem: By reading mail log and running qshape utility produces Postfix PMDA (pmdapostfix) several statistics about postfix queue and mail flow though the system. pmdapostfix is ran by pmcd daemon, and asked to provide metrics. However selinux-policy disallows access to /var/log/maillog and Postfix queue directories. These AVC denials are raised when pmdapostfix is installed and during its usage: type=AVC msg=audit(1429602211.057:2688): avc: denied { read } for pid=4801 comm="perl" name="maillog" dev="dm-0" ino=68460443 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file type=AVC msg=audit(1429602211.057:2688): avc: denied { open } for pid=4801 comm="perl" path="/var/log/maillog" dev="dm-0" ino=68460443 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file type=AVC msg=audit(1429602216.087:2689): avc: denied { read } for pid=4810 comm="postconf" name="main.cf" dev="dm-0" ino=1013985 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:postfix_etc_t:s0 tclass=file type=AVC msg=audit(1429602216.087:2689): avc: denied { open } for pid=4810 comm="postconf" path="/etc/postfix/main.cf" dev="dm-0" ino=1013985 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:postfix_etc_t:s0 tclass=file type=AVC msg=audit(1429602216.087:2690): avc: denied { getattr } for pid=4810 comm="postconf" path="/etc/postfix/main.cf" dev="dm-0" ino=1013985 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:postfix_etc_t:s0 tclass=file type=AVC msg=audit(1429602216.087:2691): avc: denied { search } for pid=4809 comm="qshape" name="postfix" dev="dm-0" ino=68620051 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:postfix_spool_t:s0 tclass=dir type=AVC msg=audit(1429602216.087:2692): avc: denied { getattr } for pid=4809 comm="qshape" path="/var/spool/postfix/maildrop" dev="dm-0" ino=135531171 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:postfix_spool_maildrop_t:s0 tclass=dir type=AVC msg=audit(1429602216.137:2693): avc: denied { getattr } for pid=4811 comm="qshape" path="/var/spool/postfix/incoming" dev="dm-0" ino=68620053 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:postfix_spool_t:s0 tclass=dir As you can see, access to /etc/postfix/main.cf is also necessary - pmcd runs pmdapostfix (as a daemon-ed process) which calls qshape which calls postconf - which reads main.cf - to get e.g. postfix's queue directory. Version-Release number of selected component (if applicable): selinux-policy-3.13.1-23.el7.noarch pcp-3.9.10-8 How reproducible: Steps to Reproduce: 1. cd /var/lib/pcp/pmdas/postfix 2. ./Install 3. pminfo -f postfix Actual results: AVCs raised, and error message "pmdapostfix(27060) Error: open failed (/var/log/maillog): Permission denied" appears in /var/log/pcp/pmcd/postfix.log Expected results: Additional info: