Bug 323251

Summary:	After some selinux update php stopped sending e-mails
Product:	[Fedora] Fedora	Reporter:	Ondrej Svetlik <ondrej>
Component:	selinux-policy-targeted	Assignee:	Daniel Walsh <dwalsh>
Status:	CLOSED NOTABUG	QA Contact:	Ben Levenson <benl>
Severity:	high	Docs Contact:
Priority:	low
Version:	7
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-10-09 15:04:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ondrej Svetlik 2007-10-08 16:19:32 UTC

Description of problem:
On my webserver everything worked fine with selinux in Enforcing mode. But after
one of updates, selinux makes PHP to log:
sh: /usr/sbin/sendmail: Permission denied
And no mail is sent.

Version-Release number of selected component (if applicable):
selinux-policy-2.6.4-46.fc7
selinux-policy-targeted-2.6.4-46.fc7
sendmail-8.14.1-4.2.fc7
httpd-2.2.6-1.fc7
php-eaccelerator-0.9.5.1-3.fc7
php-bcmath-5.2.4-1.fc7
php-mysql-5.2.4-1.fc7
php-gd-5.2.4-1.fc7
php-xml-5.2.4-1.fc7
php-5.2.4-1.fc7
php-pecl-xdebug-2.0.0-2.fc7
php-Smarty-2.6.18-1.fc7
php-channel-phpunit-1.0-2.fc7
php-pgsql-5.2.4-1.fc7
php-pdo-5.2.4-1.fc7
php-cli-5.2.4-1.fc7
php-common-5.2.4-1.fc7
php-mbstring-5.2.4-1.fc7
php-ldap-5.2.4-1.fc7


How reproducible:
always


Steps to Reproduce:
1.setenfore Enforcing
2.access a PHP page that sends an e-mail (mail() or pear's Mail)
3.I tried to set Mail to use SMTP, but there was also Permission denied error
while connecting to the port.

Actual results:
in error_log appears a line:
sh: /usr/sbin/sendmail: Permission denied
and no mail


Expected results:
No error in the log and a mail being sent.

Comment 1 Ondrej Svetlik 2007-10-08 16:21:30 UTC

from php.ini:
sendmail_path = "/usr/sbin/sendmail -t -i -O DeliveryMode=q"

Comment 2 Daniel Walsh 2007-10-09 14:53:25 UTC

Do you have the httpd_can_sendmail boolean turned on ?

getsebool -a | grep send
httpd_can_sendmail --> on


setsebool -P httpd_can_sendmail 1

Will turn it on.

Comment 3 Ondrej Svetlik 2007-10-09 15:04:22 UTC

Oh, I don't :-). Thanks a lot.