Bug 2224645

Summary:	Add SELinux policy for dovecot-pigeonhole
Product:	Red Hat Enterprise Linux 9	Reporter:	Graham Leggett <minfrin>
Component:	selinux-policy	Assignee:	Nikola Knazekova <nknazeko>
Status:	NEW ---	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	9.2	CC:	lvrabec, mmalik, zpytela
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Graham Leggett 2023-07-21 18:48:17 UTC

Description of problem:

dovecot-pigeonhole package has no selinux policy.

It is not possible to configure it, as it has nowhere to write its files.

Version-Release number of selected component (if applicable):

selinux-policy-38.1.11-2.el9_2.3.noarch
selinux-policy-targeted-38.1.11-2.el9_2.3.noarch

How reproducible:

Always.

Steps to Reproduce:
1. Install and configure dovecot-pigeonhole.
2.
3.

Actual results:

SELinux failures, because there are no directories allocated to put sieve files with the correct permissions.

Expected results:

SELinux policy that allows at least one path accessible by dovecot-pigeonhole with the correct permissions.

Additional info:

The path /var/lib/dovecot/* is allowed by selinux, but denied to all users outside the dovecot group, breaking dovecot-pigeonhole.