Bug 627208

Description of problem:

The postfix_local_t domain cannot read files in the usr_t context. One of the useful things which the postfix local delivery daemon (which runs in the postfix_local_t domain) can do is pipe mail sent to a local address to a script. If that script happens to be a Perl script which in turn loads some Perl modules, those modules will likely live under /usr/share/perl5 and have the usr_t context. If postfix_local_t lacks permission to read these files, then such scripts will fail.

Version-Release number of selected component (if applicable):

selinux-policy-targeted-3.7.19-47.fc13.noarch

How reproducible:

Always.

Steps to Reproduce:
1. Use postfix for delivering your mail.
2. Add an alias to /etc/aliases mapping some address to a Perl script.
3. Load some modules in that script, e.g., "use LWP::UserAgent;".
4. Send some mail to the address.
  
Actual results:

Various AVCs.

Expected results:

No AVCs.


Additional info:

I worked around this problem by adding the following policy module: 


module local 1.0;

require {
  type postfix_local_t;
  type usr_t;
  class file { getattr read open ioctl };
}

#============= postfix_local_t ==============
allow postfix_local_t usr_t:file { getattr read open ioctl };



This was sufficient for my particular script to work properly.