Bug 186309
| Summary: | AVC denied messages at postfix startup | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Ville Skyttä <scop> |
| Component: | selinux-policy-targeted | Assignee: | Russell Coker <rcoker> |
| Status: | CLOSED NOTABUG | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 5 | ||
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2006-04-04 09:30:10 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
i confirm the same problem. Are you seeing this is Enforcing mode? Not with selinux-policy-targeted-2.2.25-3.fc5, so assuming fixed. The previous messages I posted were produced in permissive mode. Interesting, the messages still appear in permissive mode. To clarify, only this message appeared in my last bootup in permissive mode, no
more the "find" one from the initial comment:
Apr 4 00:03:14 viper kernel: audit(1144098190.429:5): avc: denied { getattr }
for pid=2176 comm="sh" name="mailq.postfix.1.gz" dev=sda3 ino=12700923 scontex
t=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:man_t:s0 tcla
ss=file
We don't usually concern ourselves with permissive mode AVC messages. In strict policy a dontaudit rule is probably preventing the application from getting this far, so the AVC never appears. |
selinux-policy-targeted-2.2.23-15 on FC5 x86_64: these messages appear in syslog when (re)starting postfix: Mar 22 22:35:29 viper kernel: audit(1143059729.278:138): avc: denied { getattr } for pid=3593 comm="sh" name="mailq.postfix.1.gz" dev=sda3 ino=12700940 scontext=user_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:man_t:s0 tclass=file Mar 22 22:35:29 viper kernel: audit(1143059729.602:139): avc: denied { ioctl } for pid=3620 comm="find" name="2" dev=devpts ino=4 scontext=user_u:system_r:postfix_master_t:s0 tcontext=user_u:object_r:devpts_t:s0 tclass=chr_file