Bug 546970

Summary:

SELinux is preventing the sendmail from using potentially mislabeled files
/var/spool/clientmqueue (mqueue_spool_t).

Detailed Description:

SELinux has denied the sendmail access to potentially mislabeled files
/var/spool/clientmqueue. This means that SELinux will not allow httpd to use
these files. Many third party apps install html files in directories that
SELinux policy cannot predict. These directories have to be labeled with a file
context which httpd can access.

Allowing Access:

If you want to change the file context of /var/spool/clientmqueue so that the
httpd daemon can access it, you need to execute it using chcon -t
httpd_sys_content_t '/var/spool/clientmqueue'. You can look at the httpd_selinux
man page for additional information.

Additional Information:

Source Context                system_u:system_r:httpd_t:s0
Target Context                system_u:object_r:mqueue_spool_t:s0
Target Objects                /var/spool/clientmqueue [ dir ]
Source                        sendmail
Source Path                   /usr/sbin/sendmail.sendmail
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           sendmail-8.14.3-5.fc11
Target RPM Packages           sendmail-8.14.3-5.fc11
Policy RPM                    selinux-policy-3.6.12-83.fc11
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   httpd_bad_labels
Host Name                     (removed)
Platform                      Linux (removed) 2.6.30.8-64.fc11.i686.PAE #1 SMP Fri
                              Sep 25 04:56:58 EDT 2009 i686 i686
Alert Count                   1
First Seen                    Sat 10 Oct 2009 08:42:15 PM CEST
Last Seen                     Sat 10 Oct 2009 08:42:15 PM CEST
Local ID                      08e9908e-4c97-4eb1-a7ed-bc0a9565a58f
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1255200135.74:773): avc:  denied  { search } for  pid=11234 comm="sendmail" name="clientmqueue" dev=dm-1 ino=77871 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=dir

node=(removed) type=SYSCALL msg=audit(1255200135.74:773): arch=40000003 syscall=12 success=no exit=-13 a0=bfd5f37c a1=bfd5f37c a2=7a0b80 a3=7d3570 items=0 ppid=1949 pid=11234 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=51 sgid=51 fsgid=51 tty=(none) ses=4294967295 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:httpd_t:s0 key=(null)



Hash String generated from  selinux-policy-3.6.12-83.fc11,httpd_bad_labels,sendmail,httpd_t,mqueue_spool_t,dir,search
audit2allow suggests:

#============= httpd_t ==============
allow httpd_t mqueue_spool_t:dir search;