Bug 2176583

Caught in permissive mode:
----
type=PROCTITLE msg=audit(03/09/2023 09:10:38.507:471) : proctitle=/usr/sbin/arpwatch -u arpwatch -F -C 
type=PATH msg=audit(03/09/2023 09:10:38.507:471) : item=0 name=/usr/sbin/sendmail inode=1093403 dev=00:1e mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(03/09/2023 09:10:38.507:471) : cwd=/var/lib/arpwatch 
type=SYSCALL msg=audit(03/09/2023 09:10:38.507:471) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0x557e3d11130a a1=0x7ffff08c8240 a2=0x7ffff08c92e8 a3=0x557e3d111314 items=1 ppid=4373 pid=4446 auid=unset uid=arpwatch gid=arpwatch euid=arpwatch suid=arpwatch fsuid=arpwatch egid=arpwatch sgid=arpwatch fsgid=arpwatch tty=(none) ses=unset comm=arpwatch exe=/usr/sbin/arpwatch subj=system_u:system_r:arpwatch_t:s0 key=(null) 
type=AVC msg=audit(03/09/2023 09:10:38.507:471) : avc:  denied  { execute } for  pid=4446 comm=arpwatch name=msmtp dev="vda2" ino=1093403 scontext=system_u:system_r:arpwatch_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=0 
----

The problem exists for some time already because I can reproduce it on Fedora 36 VM as well:

# rpm -qa selinux\* arpwatch\* msmtp\* | sort
arpwatch-3.3-8.fc36.x86_64
msmtp-1.8.23-1.fc36.x86_64
selinux-policy-36.16-1.fc36.noarch
selinux-policy-devel-36.16-1.fc36.noarch
selinux-policy-doc-36.16-1.fc36.noarch
selinux-policy-sandbox-36.16-1.fc36.noarch
selinux-policy-targeted-36.16-1.fc36.noarch
# rpm -qf /usr/sbin/sendmail 
esmtp-1.2-19.fc36.x86_64
# ls -l /usr/sbin/sendmail 
lrwxrwxrwx. 1 root root 21 Mar  9 09:08 /usr/sbin/sendmail -> /etc/alternatives/mta
# ls -l /etc/alternatives/mta
lrwxrwxrwx. 1 root root 14 Mar  9 09:08 /etc/alternatives/mta -> /usr/bin/msmtp
#

The following SELinux denials appeared after making the arpwatch_t policy permissive:
----
type=PROCTITLE msg=audit(03/09/2023 03:48:54.293:469) : proctitle=sendmail -odi root 
type=PATH msg=audit(03/09/2023 03:48:54.293:469) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=139847 dev=fc:02 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(03/09/2023 03:48:54.293:469) : item=0 name=/usr/sbin/sendmail inode=202158 dev=fc:02 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(03/09/2023 03:48:54.293:469) : cwd=/var/lib/arpwatch 
type=EXECVE msg=audit(03/09/2023 03:48:54.293:469) : argc=3 a0=sendmail a1=-odi a2=root 
type=SYSCALL msg=audit(03/09/2023 03:48:54.293:469) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x5644e70bd30a a1=0x7fffd06ecb60 a2=0x7fffd06edc58 a3=0x5644e70bd314 items=2 ppid=1395 pid=1409 auid=unset uid=arpwatch gid=arpwatch euid=arpwatch suid=arpwatch fsuid=arpwatch egid=arpwatch sgid=arpwatch fsgid=arpwatch tty=(none) ses=unset comm=sendmail exe=/usr/bin/msmtp subj=system_u:system_r:arpwatch_t:s0 key=(null) 
type=AVC msg=audit(03/09/2023 03:48:54.293:469) : avc:  denied  { map } for  pid=1409 comm=sendmail path=/usr/bin/msmtp dev="vda2" ino=202158 scontext=system_u:system_r:arpwatch_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1 
type=AVC msg=audit(03/09/2023 03:48:54.293:469) : avc:  denied  { execute_no_trans } for  pid=1409 comm=arpwatch path=/usr/bin/msmtp dev="vda2" ino=202158 scontext=system_u:system_r:arpwatch_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1 
type=AVC msg=audit(03/09/2023 03:48:54.293:469) : avc:  denied  { execute } for  pid=1409 comm=arpwatch name=msmtp dev="vda2" ino=202158 scontext=system_u:system_r:arpwatch_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1 
----

# rpm -qa selinux\* arpwatch\* \*smtp\* | sort
arpwatch-3.3-14.fc39.x86_64
esmtp-1.2-21.fc38.x86_64
libesmtp-1.0.6-27.fc38.x86_64
msmtp-1.8.23-1.fc38.x86_64
selinux-policy-38.8-1.fc39.noarch
selinux-policy-targeted-38.8-1.fc39.noarch
#

I've submitted a Fedora PR to address the issue:
https://github.com/fedora-selinux/selinux-policy/pull/1623

Can you try the scratchbuild to see if there are any other denials on your system?
Checks -> Artifacts -> rpms.zip

Observation: the SELinux denial shown in comment#1 appears every 1 minute after restarting the arpwatch service.

Test coverage for this BZ exists in a form of MR:
 * https://gitlab.com/redhat/rhel/tests/selinux-policy/-/merge_requests/87

The MR waits for review.

I can confirm that SELinux denials do not appear after upgrading to:

# rpm -qa selinux\*
selinux-policy-38.8-1.20230309_084534.d4cfe55.fc38.noarch
selinux-policy-targeted-38.8-1.20230309_084534.d4cfe55.fc38.noarch
#

And new "permission denied" messages do not appear in the systemd journal anymore.

(In reply to Zdenek Pytela from comment #3)
> I've submitted a Fedora PR to address the issue:
> https://github.com/fedora-selinux/selinux-policy/pull/1623
> 
> Can you try the scratchbuild to see if there are any other denials on your
> system?
> Checks -> Artifacts -> rpms.zip

Tested. Like @mmalik , I confirm it addresses the issue: arpwatch is allowed to send email through msmtp's /usr/sbin/sendmail.

Thanks !

Thank you both for the feedback, merging.