Bug 2247689

Summary:	Please add support for cdb map in sendmail
Product:	[Fedora] Fedora	Reporter:	Jaroslav Škarvada <jskarvad>
Component:	selinux-policy	Assignee:	Zdenek Pytela <zpytela>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	40	CC:	dwalsh, lvrabec, mmalik, nknazeko, omosnacek, pkoncity, vmojzis, zpytela
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-40.27-1.fc40	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-08-11 04:49:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1781181

Description Jaroslav Škarvada 2023-11-02 19:30:24 UTC

This is related to the switch from libdb, bug 1781181.

Reproducible: Always

Steps to Reproduce:
1. build sendmail-8.17.2-4.fc40 --without db
2. dnf install sendmail
3. systemctl start sendmail
Actual Results:  
type=AVC msg=audit(1698951288.478:495): avc:  denied  { map } for  pid=5622 comm="sendmail" path="/etc/mail/access.cdb" dev="vda1" ino=37756176 scontext=system_u:system_r:sendmail_t:s0 tcontext=unconfined_u:object_r:etc_mail_t:s0 tclass=file permissive=1


Expected Results:  
No AVC

It also needs full R/W/CREATE/MAP access to:
/etc/mail/bitdomain.cdb
/etc/mail/uudomain.cdb
/etc/mail/genericstable.cdb
/etc/mail/userdb.cdb
/etc/mail/authinfo.cdb
/etc/mail/virtusertable.cdb
/etc/mail/access.cdb
/etc/mail/domaintable.cdb
/etc/mail/mailertable.cdb
/etc/aliases.cdb

It already should have full access to the *.db variant of the above files.

The above mentioned AVC was the only AVC I was able to get from it when running simple sanity tests.

Comment 1 Aoife Moloney 2024-02-15 23:03:33 UTC

This bug appears to have been reported against 'rawhide' during the Fedora Linux 40 development cycle.
Changing version to 40.

Comment 2 Fedora Update System 2024-08-07 10:34:15 UTC

FEDORA-2024-995d585c91 (selinux-policy-40.27-1.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-995d585c91

Comment 3 Fedora Update System 2024-08-08 04:46:44 UTC

FEDORA-2024-995d585c91 has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-995d585c91`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-995d585c91

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2024-08-11 04:49:12 UTC

FEDORA-2024-995d585c91 (selinux-policy-40.27-1.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.