Bug 539576

Zusammenfassung:

SELinux is preventing /usr/sbin/sendmail.sendmail access to a leaked
unix_stream_socket file descriptor.

Detaillierte Beschreibung:

[sendmail hat einen toleranten Typ (system_mail_t). Dieser Zugriff wurde nicht
verweigert.]

SELinux denied access requested by the sendmail command. It looks like this is
either a leaked descriptor or sendmail output was redirected to a file it is not
allowed to access. Leaks usually can be ignored since SELinux is just closing
the leak and reporting the error. The application does not use the descriptor,
so it will run properly. If this is a redirection, you will not get output in
the unix_stream_socket. You should generate a bugzilla on selinux-policy, and it
will get routed to the appropriate package. You can safely ignore this avc.

Zugriff erlauben:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385)

Zusätzliche Informationen:

Quellkontext                  system_u:system_r:system_mail_t:s0
Zielkontext                   system_u:system_r:fail2ban_t:s0
Zielobjekte                   unix_stream_socket [ unix_stream_socket ]
Quelle                        sendmail
Quellen-Pfad                  /usr/sbin/sendmail.sendmail
Port                          <Unbekannt>
Host                          (removed)
Quellen-RPM-Pakete            sendmail-8.14.3-8.fc12
Ziel-RPM-Pakete               
RPM-Richtlinie                selinux-policy-3.6.32-41.fc12
SELinux aktiviert             True
Richtlinienversion            targeted
MLS aktiviert                 True
Enforcing-Modus               Enforcing
Plugin-Name                   leaks
Hostname                      (removed)
Plattform                     Linux (removed) 2.6.31.5-127.fc12.i686.PAE
                              #1 SMP Sat Nov 7 21:25:57 EST 2009 i686 i686
Anzahl der Alarme             3
Zuerst gesehen                Fr 20 Nov 2009 08:42:16 CET
Zuletzt gesehen               Fr 20 Nov 2009 08:42:16 CET
Lokale ID                     ed848cda-32bd-484c-b485-30af68e95006
Zeilennummern                 

Raw-Audit-Meldungen           

node=(removed) type=AVC msg=audit(1258702936.591:12311): avc:  denied  { read write } for  pid=1451 comm="sendmail" path="socket:[12238]" dev=sockfs ino=12238 scontext=system_u:system_r:system_mail_t:s0 tcontext=system_u:system_r:fail2ban_t:s0 tclass=unix_stream_socket

node=(removed) type=AVC msg=audit(1258702936.591:12311): avc:  denied  { read write } for  pid=1451 comm="sendmail" path="socket:[12246]" dev=sockfs ino=12246 scontext=system_u:system_r:system_mail_t:s0 tcontext=system_u:system_r:fail2ban_t:s0 tclass=unix_dgram_socket

node=(removed) type=AVC msg=audit(1258702936.591:12311): avc:  denied  { read write } for  pid=1451 comm="sendmail" path="socket:[12255]" dev=sockfs ino=12255 scontext=system_u:system_r:system_mail_t:s0 tcontext=system_u:system_r:fail2ban_t:s0 tclass=unix_stream_socket

node=(removed) type=SYSCALL msg=audit(1258702936.591:12311): arch=40000003 syscall=11 success=yes exit=0 a0=98e5810 a1=98e67d8 a2=98e66b0 a3=98e67d8 items=0 ppid=1448 pid=1451 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=488 sgid=488 fsgid=488 tty=(none) ses=4294967295 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:system_mail_t:s0 key=(null)



Hash String generated from  selinux-policy-3.6.32-41.fc12,leaks,sendmail,system_mail_t,fail2ban_t,unix_stream_socket,read,write
audit2allow suggests:

#============= system_mail_t ==============
allow system_mail_t fail2ban_t:unix_dgram_socket { read write };
allow system_mail_t fail2ban_t:unix_stream_socket { read write };