Bug 698398

dgrift provided the following sample fix:


policy_module(myspamd, 1.0.0)
gen_require(` type spamd_t; ')
mta_send_mail(spamd_t)


which seems to be working.

Looks fine. Will add.

Please let me know when it's been checked in so I can do a mockbuild and try it out.

When is the next release of selinux-policy due out?

A new build will be available from koji today.

(In reply to comment #5)
> A new build will be available from koji today.

Can you post the URL?  Thanks.

http://koji.fedoraproject.org/koji/buildinfo?buildID=243234

(In reply to comment #7)
> http://koji.fedoraproject.org/koji/buildinfo?buildID=243234

Please also provide an f15 build.

It should be fixed in the latest F15 policy.

Seeing:

type=AVC msg=audit(1303278926.626:27678): avc:  denied  { execute } for  pid=13089 comm="mimedefang.pl" name="sendmail.sendmail" dev=sda3 ino=267135 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file

	Was caused by:
		Unknown - would be allowed by active policy
		Possible mismatch between this policy and the one under which the audit message was generated.

		Possible mismatch between current in-memory boolean settings vs. permanent ones.

Philip,

try to execute

# yum reinstall selinux-policy-targeted

Hmmm...  hard to tell. I did that, but running:

audit2why < /var/log/audit/audit.log

doesn't bother to give me recognizable timestamps, so it's hard to tell if the last occurrence of that message was before or after refreshing the package.

Is there a way to get audit2why to spew meaningful timestamps instead of seconds since the epoch (which I have to admit, I can't convert in my head)...

Ok, doing a little work:


[philipp@builder ~]$ cat /tmp/y2
#!/usr/bin/perl

my $sec = 1303278926;

use POSIX qw(strftime);

print strftime("%a %b %e %H:%M:%S %Y", localtime($sec)), "\n";
[philipp@builder ~]$ /tmp/y2
Tue Apr 19 23:55:26 2011
[philipp@builder ~]$ 

Ok, so it seems that I've not seen it in a while.

ausearch is the tool that will translate the time stamps, I also run it with the -i flag to translate UID and syscall info.

(In reply to comment #11)
> Philip,
> 
> try to execute
> 
> # yum reinstall selinux-policy-targeted

It seems to be working. Please go ahead and close this.

I'm running:

selinux-policy-targeted-3.9.16-26.fc15.noarch

without incident.

Ok, thanks.

This seems to have regressed.

type=AVC msg=audit(11/23/2011 00:07:37.218:572) : avc:  denied  { execute } for  pid=11464 comm=mimedefang.pl name=sendmail.sendmail dev=sda3 ino=266985 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file 
type=AVC msg=audit(11/23/2011 00:07:37.339:573) : avc:  denied  { execute } for  pid=11467 comm=mimedefang.pl name=sendmail.sendmail dev=sda3 ino=266985 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file 
type=AVC msg=audit(11/23/2011 01:01:57.074:583) : avc:  denied  { execute } for  pid=11623 comm=mimedefang.pl name=sendmail.sendmail dev=sda3 ino=266985 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file 
type=AVC msg=audit(11/23/2011 01:01:57.196:584) : avc:  denied  { execute } for  pid=11626 comm=mimedefang.pl name=sendmail.sendmail dev=sda3 ino=266985 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file

I'm running:

selinux-policy-targeted-3.10.0-56.fc16.noarch
selinux-policy-3.10.0-56.fc16.noarch

audit2allow tells me we need:

module mimedefang 1.0;

require {
	type spamd_t;
	type sendmail_exec_t;
	class file execute;
}

#============= spamd_t ==============
allow spamd_t sendmail_exec_t:file execute;


or at least merge this with existing policy.

Added to F16.

selinux-policy-3.10.0-59.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-59.fc16

Package selinux-policy-3.10.0-60.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-60.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2011-16371/selinux-policy-3.10.0-60.fc16
then log in and leave karma (feedback).

Package selinux-policy-3.10.0-61.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-61.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2011-16371/selinux-policy-3.10.0-61.fc16
then log in and leave karma (feedback).

(In reply to comment #21)
> Package selinux-policy-3.10.0-61.fc16:
> * should fix your issue,
> * was pushed to the Fedora 16 testing repository,
> * should be available at your local mirror within two days.
> Update it with:
> # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-61.fc16'
> as soon as you are able to.
> Please go to the following url:
> https://admin.fedoraproject.org/updates/FEDORA-2011-16371/selinux-policy-3.10.0-61.fc16
> then log in and leave karma (feedback).

Was there a reason to not fix 753962 in build .61?

yes, i was ill and 60, 61 releases contain only q spec file change, not policy changes.

selinux-policy-3.10.0-61.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Is this in master/rawhide as well as f16?

Yes, it is.