Bug 413601
| Summary: | SELinux prevents Postfix from accessing the Postgrey policy service socket | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Anthony Messina <amessina> |
| Component: | selinux-policy-targeted | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED NEXTRELEASE | QA Contact: | Ben Levenson <benl> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 7 | ||
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2007-12-06 15:43:11 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
This is fixed in Fedora 8 I think it is best if you just add custom rules for this using audit2allow. grep postfix /var/log/audit/audit.log | audit2allow -M mypostfix semodule -i mypostfix.pp |
Description of problem: In permissive mode, SELinux denies the Postfix smtpd process from connecting (and probably writing) to the Postgrey socket. I am using the Fedora 7 Postfix and Postgrey RPMs. Also, the Postgrey socket is probably labeled improperly as it gets the initrc_t type after a reboot. Version-Release number of selected component (if applicable): postfix-2.4.5-2.fc7 postgrey-1.27-4.fc7 selinux-policy-targeted-2.6.4-57.fc7 How reproducible: Each time Postfix is configured to use the Postgrey policy service Actual results: avc: denied { connectto } for comm="smtpd" dev=sda2 egid=89 euid=89 exe="/usr/libexec/postfix/smtpd" exit=0 fsgid=89 fsuid=89 gid=89 items=0 name="socket" path="/var/spool/postfix/postgrey/socket" pid=5176 scontext=system_u:system_r:postfix_smtpd_t:s0 sgid=89 subj=system_u:system_r:postfix_smtpd_t:s0 suid=89 tclass=unix_stream_socket tcontext=system_u:system_r:initrc_t:s0 tty=(none) uid=8 avc: denied { write } for comm="smtpd" dev=sda2 egid=89 euid=89 exe="/usr/libexec/postfix/smtpd" exit=0 fsgid=89 fsuid=89 gid=89 items=0 name="socket" pid=24378 scontext=root:system_r:postfix_smtpd_t:s0 sgid=89 subj=root:system_r:postfix_smtpd_t:s0 suid=89 tclass=sock_file tcontext=root:object_r:postfix_spool_t:s0 tty=(none) uid=89 Expected results: SELinux will allow the Postfix process to use the Postgrey socket.