Bug 216324
| Summary: | /usr/bin/uux can't access files in /var/{log,spool}/uucp (or its own binary) when run from postfix | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Nils Philippsen <nphilipp> | ||||||||
| Component: | selinux-policy-targeted | Assignee: | Daniel Walsh <dwalsh> | ||||||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Ben Levenson <benl> | ||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | medium | ||||||||||
| Version: | 6 | ||||||||||
| Target Milestone: | --- | ||||||||||
| Target Release: | --- | ||||||||||
| Hardware: | All | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | Current | Doc Type: | Bug Fix | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2007-08-22 14:14:09 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Attachments: |
|
||||||||||
Created attachment 141689 [details]
te file
Created attachment 141690 [details]
if file
Created attachment 141691 [details]
fc file
I have built a policy for uux, I will add this to policy once it is working. Could you extract the three attachments above into thier own directory Then install selinux-policy-devel And execute make -f /usr/share/selinux/devel/Makefile semodule -i uux.pp restorecon /usr/bin/uux setenforce 0 Run the test with postfix. Send me the avc messages that are generated. Fixed in selinux-policy-2.4.5-3.fc6 Fixed in current release |
Description of problem: When called by postfix to execute remotely queued UUCP commands, several actions uux wants to do are denied by SELinux. Version-Release number of selected component (if applicable): selinux-policy-targeted-2.4.3-2.fc6 uucp-1.07-12 postfix-2.3.3-2 How reproducible: Reproducible (the alerts come regularly). Steps to Reproduce: 1. Set up system as a UUCP node sending and receiving mail via UUCP (over TCP) from an external server. 2. Get mail sent from outside. Actual results: With /usr/bin/uux being labelled as "-r-sr-xr-x uucp uucp system_u:object_r:bin_t /usr/bin/uux", I get e.g.: avc: denied { getattr } for comm='"uux"' dev='dm-0' egid='14' euid='10' exe='"/usr/bin/uux"' exit='0' fsgid='14' fsuid='10' gid='14' items='0' name='"Log"' path='"/var/log/uucp/Log"' pid='9856' scontext=system_u:system_r:postfix_pipe_t:s0 sgid='14' subj='system_u:system_r:postfix_pipe_t:s0' suid='10' tclass='file' tcontext=system_u:object_r:uucpd_log_t:s0 tty='(none)' uid='10' avc: denied { append } for comm='"uux"' dev='dm-0' egid='14' euid='10' exe='"/usr/bin/uux"' exit='4' fsgid='14' fsuid='10' gid='14' items='0' name='"Log"' pid='9856' scontext=system_u:system_r:postfix_pipe_t:s0 sgid='14' subj='system_u:system_r:postfix_pipe_t:s0' suid='10' tclass='file' tcontext=system_u:object_r:uucpd_log_t:s0 tty='(none)' uid='10' avc: denied { unlink } for comm='"uux"' dev='dm-0' egid='14' euid='10' exe='"/usr/bin/uux"' exit='0' fsgid='14' fsuid='10' gid='14' items='0' name='"TMP00000001fe"' pid='510' scontext=system_u:system_r:postfix_pipe_t:s0 sgid='14' subj='system_u:system_r:postfix_pipe_t:s0' suid='10' tclass='file' tcontext=system_u:object_r:uucpd_spool_t:s0 tty='(none)' uid='10' avc: denied { getattr } for comm='"uux"' dev='dm-0' egid='14' euid='10' exe='"/usr/bin/uux"' exit='0' fsgid='14' fsuid='10' gid='14' items='0' name='"D.05SN"' path='"/var/spool/uucp/winz/D./D.05SN"' pid='510' scontext=system_u:system_r:postfix_pipe_t:s0 sgid='14' subj='system_u:system_r:postfix_pipe_t:s0' suid='10' tclass='file' tcontext=system_u:object_r:uucpd_spool_t:s0 tty='(none)' uid='10' avc: denied { create } for comm='"uux"' dev='dm-0' egid='14' euid='10' exe='"/usr/bin/uux"' exit='4' fsgid='14' fsuid='10' gid='14' items='0' name='"D.05SN"' pid='510' scontext=system_u:system_r:postfix_pipe_t:s0 sgid='14' subj='system_u:system_r:postfix_pipe_t:s0' suid='10' tclass='file' tcontext=system_u:object_r:uucpd_spool_t:s0 tty='(none)' uid='10' avc: denied { lock } for comm='"uux"' dev='dm-0' egid='14' euid='10' exe='"/usr/bin/uux"' exit='0' fsgid='14' fsuid='10' gid='14' items='0' name='"SEQF"' path='"/var/spool/uucp/winz/SEQF"' pid='9858' scontext=system_u:system_r:postfix_pipe_t:s0 sgid='14' subj='system_u:system_r:postfix_pipe_t:s0' suid='10' tclass='file' tcontext=system_u:object_r:uucpd_spool_t:s0 tty='(none)' uid='10' avc: denied { read, write } for comm='"uux"' dev='dm-0' egid='14' euid='10' exe='"/usr/bin/uux"' exit='4' fsgid='14' fsuid='10' gid='14' items='0' name='"SEQF"' pid='9858' scontext=system_u:system_r:postfix_pipe_t:s0 sgid='14' subj='system_u:system_r:postfix_pipe_t:s0' suid='10' tclass='file' tcontext=system_u:object_r:uucpd_spool_t:s0 tty='(none)' uid='10' avc: denied { search } for comm='"uux"' dev='dm-0' egid='14' euid='10' exe='"/usr/bin/uux"' exit='0' fsgid='14' fsuid='10' gid='14' items='0' name='"uucp"' pid='9858' scontext=system_u:system_r:postfix_pipe_t:s0 sgid='14' subj='system_u:system_r:postfix_pipe_t:s0' suid='10' tclass='dir' tcontext=system_u:object_r:uucpd_spool_t:s0 tty='(none)' uid='10' avc: denied { read } for comm='"uux"' dev='dm-2' egid='14' euid='10' exe='"/usr/bin/uux"' exit='0' fsgid='14' fsuid='10' gid='14' items='0' name='"uux"' path='"/usr/bin/uux"' pid='9856' scontext=system_u:system_r:postfix_pipe_t:s0 sgid='14' subj='system_u:system_r:postfix_pipe_t:s0' suid='10' tclass='file' tcontext=system_u:object_r:bin_t:s0 tty='(none)' uid='10' and many more. Expected results: File ops on these files granted, no AVC alerts. Additional info: