Bug 1320415

Summary: SELinux is preventing /usr/libexec/dovecot/auth from 'write' accesses on the fifo_file stats-user.
Product: [Fedora] Fedora Reporter: Michael Chapman <redhat-bugzilla>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED EOL QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 22CC: dominick.grift, dwalsh, fedora.jrg01, gigalamer, lvrabec, mgrepl, plautrba
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:dfeac7858c9f83a925689cc8fd5470fb6ad70e6bb3afaf048d77be673dfe33b7;
Fixed In Version: selinux-policy-3.13.1-128.29.fc22 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-07-19 18:46:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Michael Chapman 2016-03-23 07:41:22 UTC
Description of problem:
This SELinux alert was generated when Dovecot's "auth" process started up.
SELinux is preventing /usr/libexec/dovecot/auth from 'write' accesses on the fifo_file stats-user.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that auth should be allowed write access on the stats-user fifo_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep auth /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:dovecot_auth_t:s0
Target Context                system_u:object_r:dovecot_var_run_t:s0
Target Objects                stats-user [ fifo_file ]
Source                        auth
Source Path                   /usr/libexec/dovecot/auth
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           dovecot-2.2.22-1.fc22.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-128.28.fc22.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 4.4.6-200.fc22.x86_64 #1 SMP Wed
                              Mar 16 22:13:40 UTC 2016 x86_64 x86_64
Alert Count                   3
First Seen                    2016-03-23 18:35:41 AEDT
Last Seen                     2016-03-23 18:37:17 AEDT
Local ID                      cdde354c-2258-46a9-b160-6355d70dfd09

Raw Audit Messages
type=AVC msg=audit(1458718637.414:5761): avc:  denied  { write } for  pid=7894 comm="auth" name="stats-user" dev="tmpfs" ino=526249 scontext=system_u:system_r:dovecot_auth_t:s0 tcontext=system_u:object_r:dovecot_var_run_t:s0 tclass=fifo_file permissive=1


type=AVC msg=audit(1458718637.414:5761): avc:  denied  { open } for  pid=7894 comm="auth" path="/run/dovecot/stats-user" dev="tmpfs" ino=526249 scontext=system_u:system_r:dovecot_auth_t:s0 tcontext=system_u:object_r:dovecot_var_run_t:s0 tclass=fifo_file permissive=1


type=SYSCALL msg=audit(1458718637.414:5761): arch=x86_64 syscall=open success=yes exit=ENOTBLK a0=55e7e61022f0 a1=801 a2=b a3=0 items=0 ppid=7776 pid=7894 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=auth exe=/usr/libexec/dovecot/auth subj=system_u:system_r:dovecot_auth_t:s0 key=(null)

Hash: auth,dovecot_auth_t,dovecot_var_run_t,fifo_file,write

Version-Release number of selected component:
selinux-policy-3.13.1-128.28.fc22.noarch

Additional info:
reporter:       libreport-2.6.4
hashmarkername: setroubleshoot
kernel:         4.4.6-200.fc22.x86_64
type:           libreport

Comment 1 Lukas Vrabec 2016-03-29 16:01:39 UTC
commit eb22fb7da607a693ded39cb0f0cf64b4c894058e
Author: Lukas Vrabec <lvrabec>
Date:   Tue Mar 29 18:00:09 2016 +0200

    Allow dovecot_auth_t domain to manage also dovecot_var_run_t fifo files. BZ(1320415)

Comment 2 Mike Gerber 2016-04-12 16:42:07 UTC
I have the same issue. Where can I get selinux-policy-3.13.1-128.29.fc22? It is not in updates-testing yet, nor can I find it in Koji.

Comment 3 Mike Gerber 2016-04-14 12:50:51 UTC
For the other users:

# cat /root/selinux/local-fix-dovecot-BZ1320415.te

module local-fix-dovecot-BZ1320415 1.0;

require {
	type dovecot_auth_t;
	type dovecot_var_run_t;
	class fifo_file { open write };
}

#============= dovecot_auth_t ==============
allow dovecot_auth_t dovecot_var_run_t:fifo_file open;
allow dovecot_auth_t dovecot_var_run_t:fifo_file write;

Comment 4 Fedora End Of Life 2016-07-19 18:46:46 UTC
Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.