Bug 123269

Summary:	sendmail.postfix should be allowed to search postfix_etc_t:dir
Product:	[Fedora] Fedora	Reporter:	Aleksey Nogin <aleksey>
Component:	policy	Assignee:	Daniel Walsh <dwalsh>
Status:	CLOSED RAWHIDE	QA Contact:	Ben Levenson <benl>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	dwalsh, jdennis, pgraner, sundaram
Target Milestone:	---	Keywords:	SELinux
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-05-05 15:04:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Aleksey Nogin 2004-05-15 07:17:07 UTC

Currently (policy-sources-1.11.3-3), /usr/sbin/sendmail.postfix is
marked as system_u:object_r:sendmail_exec_t which causes problems as
sendmail.postfix tries to read postfix configs, which sendmail_t is
not allowed to do. I do not see any reason why
/usr/sbin/sendmail.postfix would need to be sendmail_exec_t; I believe
it should be postfix_exec_t instead.

Comment 1 Aleksey Nogin 2004-05-15 09:00:03 UTC

On second thought, there is a reason for /usr/sbin/sendmail.postfix to
be system_u:object_r:sendmail_exec_t. Hm, in that case we need to add

allow sendmail_t postfix_etc_t:dir { search };

Comment 2 Daniel Walsh 2004-06-02 19:05:53 UTC

Fixed in selinux-policy-strict-1.13.2-7.src.rpm

Comment 3 Aleksey Nogin 2004-06-15 03:26:20 UTC

I ended up having to allow the following 3 things:

allow sendmail_t postfix_spool_t:dir { search };
allow sendmail_t postfix_etc_t:dir { search };
allow sendmail_t postfix_etc_t:file { read };

Comment 4 Rahul Sundaram 2005-09-05 00:39:13 UTC

has the above changes been added to the policy?

Comment 5 Daniel Walsh 2005-09-06 20:54:33 UTC

I am adding them now.

Missed this update.

Comment 7 Daniel Walsh 2006-05-05 15:04:09 UTC

Closing as these have been marked as modified, for a while.  Feel free to reopen
if not fixed