Bug 1757950
| Summary: | SELinux prevents opendkim from executing sendmail | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Göran Uddeborg <goeran> |
| Component: | selinux-policy-targeted | Assignee: | Nikola Knazekova <nknazeko> |
| Status: | CLOSED ERRATA | QA Contact: | Ben Levenson <benl> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 31 | CC: | dwalsh, lvrabec |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-10-29 01:27:58 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
commit 43323aaffb63c88d7f95a8e216434e6f3d95a528 (HEAD -> rawhide, origin/rawhide, origin/HEAD)
Author: Nikola Knazekova <nknazeko>
Date: Fri Oct 4 13:17:01 2019 +0200
Allow dkim to execute sendmail
Allow DomainKeys Identified Mail, an email authentication method, to execute Sendmail.
Fixed Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1757950
FEDORA-2019-7ef1fde499 has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2019-7ef1fde499 selinux-policy-3.14.4-38.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-7ef1fde499 FEDORA-2019-7d65c50fd6 has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2019-7d65c50fd6 selinux-policy-3.14.4-39.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-7d65c50fd6 selinux-policy-3.14.4-39.fc31 has been pushed to the Fedora 31 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: When opendkim finds a mail with an invalid signature, it tries to send another mail reporting about the failure. SELinux doesn't allow this, however, as the dkim_milter_t domain isn't allowed to execute or getattr on sendmail_exec_t. The result is the warning mail is never sent. Version-Release number of selected component (if applicable): selinux-policy-targeted-3.14.4-35.fc31.noarch How reproducible: Every mail with a broken dkim signature Steps to Reproduce: 1. Configure sendmail to use opendkim 2. Give it a mail with a broken dkim signature Actual results: No warning mail, and three AVCs: time->Tue Oct 1 19:41:39 2019 type=AVC msg=audit(1569951699.612:151930): avc: denied { execute } for pid=919260 comm="sh" name="sendmail.sendmail" dev="dm-0" ino=117424600 scontext=system_u:system_r:dkim_milter_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file permissive=0 ---- time->Tue Oct 1 19:41:39 2019 type=AVC msg=audit(1569951699.613:151931): avc: denied { getattr } for pid=919260 comm="sh" path="/usr/sbin/sendmail.sendmail" dev="dm-0" ino=117424600 scontext=system_u:system_r:dkim_milter_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file permissive=0 ---- time->Tue Oct 1 19:41:39 2019 type=AVC msg=audit(1569951699.613:151932): avc: denied { getattr } for pid=919260 comm="sh" path="/usr/sbin/sendmail.sendmail" dev="dm-0" ino=117424600 scontext=system_u:system_r:dkim_milter_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file permissive=0 Expected results: No AVCs and a warning mail. Additional info: This is kind of a follow up to bug 1716937. There I reported an AVC in an earlier stage in the reporting. When that was fixed this problem showed up. I reopened that bugzilla, but thinking about it a second time, that in a way trying to report more than one problem in one bugzilla. That is probably not a good idea, and here I'm opening this separate bugzilla instead for the later problem. Tested with the F31 version of the policy.