Bug 1595328

Summary: various postfix* processes trigger SELinux denials with { map }
Product: Red Hat Enterprise Linux 7 Reporter: Milos Malik <mmalik>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: high Docs Contact:
Priority: high    
Version: 7.6CC: lvrabec, mgrepl, mmalik, plautrba, ssekidde
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-10-30 10:05:54 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Milos Malik 2018-06-26 15:54:24 UTC
Description of problem:

Version-Release number of selected component (if applicable):
postfix-2.10.1-7.el7.x86_64
selinux-policy-3.13.1-204.el7.noarch
selinux-policy-devel-3.13.1-204.el7.noarch
selinux-policy-doc-3.13.1-204.el7.noarch
selinux-policy-minimum-3.13.1-204.el7.noarch
selinux-policy-mls-3.13.1-204.el7.noarch
selinux-policy-sandbox-3.13.1-204.el7.noarch
selinux-policy-targeted-3.13.1-204.el7.noarch

How reproducible:
 * always

Steps to Reproduce:
1. get a RHEL-7.6 machine (targeted policy is active)
2. run following automated TC:
 * /CoreOS/selinux-policy/Regression/bz719261-SELinux-policy-forbidds-resending-of-queued
3. search for SELinux denials

Actual results:
----
type=PROCTITLE msg=audit(06/26/2018 02:59:07.560:86) : proctitle=(null) 
type=PATH msg=audit(06/26/2018 02:59:07.560:86) : item=1 name=/lib64/ld-linux-x8
6-64.so.2 inode=313037 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 ob
j=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 c
ap_fver=0 
type=PATH msg=audit(06/26/2018 02:59:07.560:86) : item=0 name=/usr/libexec/postfix/smtp inode=983522 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:postfix_smtp_exec_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=CWD msg=audit(06/26/2018 02:59:07.560:86) :  cwd=/var/spool/postfix 
type=SYSCALL msg=audit(06/26/2018 02:59:07.560:86) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0x562e563a9540 a1=0x562e563a98b0 a2=0x562e563a2f60 a3=0xffffffff items=2 ppid=1400 pid=1413 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=smtp exe=/usr/libexec/postfix/smtp subj=system_u:system_r:postfix_master_t:s0 key=(null) 
type=AVC msg=audit(06/26/2018 02:59:07.560:86) : avc:  denied  { map } for  pid=1413 comm=smtp path=/usr/libexec/postfix/smtp dev="dm-0" ino=983522 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:postfix_smtp_exec_t:s0 tclass=file permissive=0 
----
type=PROCTITLE msg=audit(06/26/2018 04:00:42.518:271) : proctitle=(null) 
type=PATH msg=audit(06/26/2018 04:00:42.518:271) : item=1 name=/lib64/ld-linux-x
86-64.so.2 inode=313037 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 o
bj=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 
cap_fver=0 
type=PATH msg=audit(06/26/2018 04:00:42.518:271) : item=0 name=/usr/sbin/postdrop inode=587060 dev=fd:00 mode=file,sgid,755 ouid=root ogid=postdrop rdev=00:00 obj=system_u:object_r:postfix_postdrop_exec_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=CWD msg=audit(06/26/2018 04:00:42.518:271) :  cwd=/var/spool/postfix 
type=SYSCALL msg=audit(06/26/2018 04:00:42.518:271) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0x55597ef8c390 a1=0x55597ef8c3c0 a2=0x55597ef8b560 a3=0x2 items=2 ppid=983 pid=986 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=postdrop exe=/usr/sbin/postdrop subj=system_u:system_r:sendmail_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(06/26/2018 04:00:42.518:271) : avc:  denied  { map } for  pid=986 comm=postdrop path=/usr/sbin/postdrop dev="dm-0" ino=587060 scontext=system_u:system_r:sendmail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:postfix_postdrop_exec_t:s0 tclass=file permissive=0 
----
type=PROCTITLE msg=audit(06/26/2018 11:46:17.804:343) : proctitle=(null) 
type=PATH msg=audit(06/26/2018 11:46:17.804:343) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=313037 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=PATH msg=audit(06/26/2018 11:46:17.804:343) : item=0 name=/usr/libexec/postfix/showq inode=587049 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:postfix_showq_exec_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=CWD msg=audit(06/26/2018 11:46:17.804:343) :  cwd=/var/spool/postfix 
type=SYSCALL msg=audit(06/26/2018 11:46:17.804:343) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0x555adaa6db90 a1=0x555adaa6ddf0 a2=0x555adaa66f50 a3=0xffffffff items=2 ppid=18911 pid=24771 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=showq exe=/usr/libexec/postfix/showq subj=system_u:system_r:postfix_master_t:s0 key=(null) 
type=AVC msg=audit(06/26/2018 11:46:17.804:343) : avc:  denied  { map } for  pid=24771 comm=showq path=/usr/libexec/postfix/showq dev="dm-0" ino=587049 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:postfix_showq_exec_t:s0 tclass=file permissive=0 
----
type=PROCTITLE msg=audit(06/26/2018 11:46:17.805:342) : proctitle=(null) 
type=PATH msg=audit(06/26/2018 11:46:17.805:342) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=313037 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=PATH msg=audit(06/26/2018 11:46:17.805:342) : item=0 name=/usr/libexec/postfix/cleanup inode=587028 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:postfix_cleanup_exec_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=CWD msg=audit(06/26/2018 11:46:17.805:342) :  cwd=/var/spool/postfix 
type=SYSCALL msg=audit(06/26/2018 11:46:17.805:342) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0x555adaa6b140 a1=0x555adaa6b6d0 a2=0x555adaa66f50 a3=0xffffffff items=2 ppid=18911 pid=24770 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=cleanup exe=/usr/libexec/postfix/cleanup subj=system_u:system_r:postfix_master_t:s0 key=(null) 
type=AVC msg=audit(06/26/2018 11:46:17.805:342) : avc:  denied  { map } for  pid=24770 comm=cleanup path=/usr/libexec/postfix/cleanup dev="dm-0" ino=587028 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:postfix_cleanup_exec_t:s0 tclass=file permissive=0 
----

Expected results:
 * no SELinux denials

Comment 4 errata-xmlrpc 2018-10-30 10:05:54 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3111