Bug 466235
| Summary: | SELinux is preventing master (postfix_master_t) "write" to ./postfix (var_lib_t) | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Dave Mitchell <davem> |
| Component: | selinux-policy-targeted | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Ben Levenson <benl> |
| Severity: | high | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8 | CC: | eric-bugs, fedora.jrg01, gene-redhat, i.grok, jlayton, jonstanley, mark, natonato73, twoerner |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | F8 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2008-11-26 17:37:51 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Dave Mitchell
2008-10-09 10:26:14 UTC
The context for /var/lib/postfix needs to get changed in selinux-policy-targeted for the new postfix package. As an interim solution you could set the context of /var/lib/postfix to system_u:object_r:postfix_var_lib_t:s0 with chcon. Reassigning to selinux-policy-targeted. Except, the context system_u:object_r:postfix_var_lib_t:s0 doesn't exist in the current Fedora 8 selinux-policy-targeted package so doing that will fail. There is a magic dance some nice person (domg472) in #selinux gave me:
First, make sure selinux-policy-devel is installed.
mkdir ~/mypostfix
cd ~/mypostfix
vi mypostfix.te
-------
policy_module(mypostfix, 0.0.1)
type postfix_var_lib_t;
files_type(postfix_var_lib_t)
require { type postfix_master_t; }
manage_dirs_pattern(postfix_master_t, postfix_var_lib_t, postfix_var_lib_t)
manage_files_pattern(postfix_master_t, postfix_var_lib_t, postfix_var_lib_t)
files_search_var_lib(postfix_master_t)
-------
make -f /usr/share/selinux/devel/Makefile
/usr/sbin/semodule -i mypostfix.pp
/usr/sbin/semanage fcontext -a -t postfix_var_lib_t "/var/lib/postfix(/.*)?"
restorecon -vR /var/lib/postfix
That hack has taken me a bit further; now I get a new error trying to start postfix: Oct 11 17:45:39 pigeon setroubleshoot: SELinux is preventing postfix (sendmail_t) "execute" to ./postfix-script (postfix_exec_t). For complete SELinux messages. run sealert -l b5b91e16-8a62-499a-bfd2-7c875c8d256e [root@pigeon mypostfix]# ls -lZ /etc/postfix/postfix-script -rwxr-xr-x root root system_u:object_r:postfix_exec_t:s0 /etc/postfix/postfix-script [root@pigeon mypostfix]# sealert -l b5b91e16-8a62-499a-bfd2-7c875c8d256e Summary: SELinux is preventing postfix (sendmail_t) "execute" to ./postfix-script (postfix_exec_t). Detailed Description: SELinux denied access requested by postfix. It is not expected that this access is required by postfix and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./postfix-script, restorecon -v './postfix-script' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:sendmail_t:s0 Target Context system_u:object_r:postfix_exec_t:s0 Target Objects ./postfix-script [ file ] Source postfix Source Path /usr/sbin/postfix Port <Unknown> Host pigeon Source RPM Packages postfix-2.5.5-1.fc8 Target RPM Packages Policy RPM selinux-policy-3.0.8-117.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name pigeon Platform Linux pigeon 2.6.26.5-28.fc8 #1 SMP Sat Sep 20 09:32:58 EDT 2008 i686 i686 Alert Count 3 First Seen Sat Oct 11 17:37:56 2008 Last Seen Sat Oct 11 17:45:39 2008 Local ID b5b91e16-8a62-499a-bfd2-7c875c8d256e Line Numbers Raw Audit Messages host=pigeon type=AVC msg=audit(1223743539.224:781): avc: denied { execute } for pid=521 comm="postfix" name="postfix-script" dev=dm-2 ino=1836888 scontext=system_u:system_r:sendmail_t:s0 tcontext=system_u:object_r:postfix_exec_t:s0 tclass=file host=pigeon type=SYSCALL msg=audit(1223743539.224:781): arch=40000003 syscall=11 success=no exit=-13 a0=b9052c30 a1=bff71604 a2=b9052b50 a3=b9052c30 items=0 ppid=1 pid=521 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=2 comm="postfix" exe="/usr/sbin/postfix" subj=system_u:system_r:sendmail_t:s0 key=(null) ignore my previous comment. For some reason I was typing
service sendmail start
rather than
service postfix start
D'oh! Works now.
*** Bug 466609 has been marked as a duplicate of this bug. *** *** Bug 466664 has been marked as a duplicate of this bug. *** I believe this might be fixed in selinux-policy-3.0.8-118.fc8 I have upgraded to the f9 policy for postfix. The real problem here might be that you have the postfix executable running as sendmail_t? No, if you look carefully at the comments, Dave and I both got bitten by the lack of a postfix_var_lib_t and associated rules. The instructions in Comment #3 fixed that for me and Dave both. However, as Dave explained in Comment #5, he thought he had other problems on top of that, but was typing the wrong command. If there is any lingering doubt: $ ps -eo user,label,command|grep postfix|grep -v grep root unconfined_u:system_r:postfix_master_t /usr/libexec/postfix/master postfix unconfined_u:system_r:postfix_qmgr_t qmgr -l -t fifo -u postfix unconfined_u:system_r:postfix_pickup_t pickup -l -t fifo -u (unconfined_u because I started the service after bootup, due to the aforementioned selinux-policy-targeted bug). What I'm curious about is how to handle the custom policy/fcontext rules when the new update is installed. Will the custom policy/fcontext rules get thrown out? Will it conflict? Will I need to uninstall it first? Ok I looked again and made an update to selinux-policy-3.0.8-119.fc8 WHich allows sendmail_t to transition to postfix_master_t as it does in F9 and F10. This package should be in Fedora Testing soon, or you can grab it from koji. This message is a reminder that Fedora 8 is nearing its end of life. Approximately 30 (thirty) days from now Fedora will stop maintaining and issuing updates for Fedora 8. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '8'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 8's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 8 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora please change the 'version' of this bug to the applicable version. If you are unable to change the version, please add a comment here and someone will do it for you. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping As this bug is in MODIFIED, Fedora believes that a fix has been committed that resolves the problem listed in this bug report. If this is not the case, please re-open this report, noting the version of the package that you reproduced the bug against. Thanks for the report! |