Bug 447450

Summary:	fatal: tls_prng_exch_open: cannot open PRNG exchange file /var/lib/postfix/prng_exch: Permission denied
Product:	[Fedora] Fedora	Reporter:	Mads Kiilerich <mads>
Component:	postfix	Assignee:	Thomas Woerner <twoerner>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	low	Docs Contact:
Priority:	low
Version:	9
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-05-20 09:04:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mads Kiilerich 2008-05-19 23:00:22 UTC

Description of problem:
Postfix tlsmgr dies with permission error, and that can DOS the mail system.

Version-Release number of selected component (if applicable):
postfix-2.5.1-2.fc9.i386

How reproducible:
yes, I assume

Steps to Reproduce:
1. Mail works with the following in Fedora 8 postfix main.cf:
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_type = cyrus
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt
2. upgrade to Fedora 9
3. can't send mail
  
Actual results:
May 20 00:47:39 localhost postfix/master[14239]: warning: process
/usr/libexec/postfix/tlsmgr pid 14513 exit status 1
May 20 00:47:39 localhost postfix/master[14239]: warning:
/usr/libexec/postfix/tlsmgr: bad command startup -- throttling
May 20 00:48:39 localhost postfix/tlsmgr[14562]: fatal: tls_prng_exch_open:
cannot open PRNG exchange file /var/lib/postfix/prng_exch: Permission denied
May 20 00:48:40 localhost postfix/master[14239]: warning: process
/usr/libexec/postfix/tlsmgr pid 14562 exit status 1
May 20 00:48:40 localhost postfix/master[14239]: warning:
/usr/libexec/postfix/tlsmgr: bad command startup -- throttling

Additional info:
http://mail-index.netbsd.org/pkgsrc-users/2008/03/14/msg000561.html claims that
it has been solved in 2.5.1nb1

Problem might be related to issue 437042 and how it is solved.

A workaround is to add
tls_random_exchange_name = /var/spool/postfix/saved/prng_exch
which makes it work for me ... but I don't know if saved is the right place.

And I don't know what the real problem really is. But I think it might be worth
a backport of upgrade.

Comment 1 Mads Kiilerich 2008-05-19 23:03:56 UTC

Bad markup, sorry, not "issue 437042" but https://bugzilla.redhat.com/437042

Comment 2 Thomas Woerner 2008-05-20 09:04:21 UTC


*** This bug has been marked as a duplicate of 447454 ***

Comment 3 Mads Kiilerich 2008-05-20 19:42:10 UTC

Ok. This bug report is an example of selinux confusing admins. I should have
considered blaming selinux and looked for selinux messages. Apparently my
sealart isn't working.

For the record: new selinux rules fixes the problem.