Bug 733869
| Summary: | selinux policy for qmail service prevents qmail-inject/sendmail | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | adi | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 6.3 | CC: | dwalsh, mmalik | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-3.7.19-109.el6 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | |||||||
| : | 734116 (view as bug list) | Environment: | |||||
| Last Closed: | 2011-12-06 10:15:36 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 734116 | ||||||
| Attachments: |
|
||||||
Thanks for the patch. I am adding it. Fixed in selinux-policy-3.7.19-109.el6 Responding to Milos Malik's needinfo: Sorry, I found this bug in CentOS, not RHEL6, and the latest selinux-policy package Miroslav applied the patch in has not yet been pushed out to CentOS 6. Not sure if this is an issue with CentOS or RHEL 6. I'll go try to find the latest selinux-policy RPM so I can verify it's fixed. Okay, I don't know how to get the selinux-policy-3.7.19-109.el6 package in order to test it. It makes sense that it's not released yet, and pushed out to RHEL6 / CentOS6 -- since it hasn't passed QA yet. But where do I download the package in order to test it? Here is latest policy: http://people.redhat.com/dwalsh/SELinux/RHEL6/noarch/ (In reply to comment #8) > Here is latest policy: http://people.redhat.com/dwalsh/SELinux/RHEL6/noarch/ Thanks. Okay, I installed selinux-policy-{,targeted-}3.7.19-117.el6.noarch, and triggered the test case of crond generated mail, and the mail was delivered. I also tested by qmail-inject directly via command line, and that also worked. No AVC errors in audit.log. So it passes QA from my perspective. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1511.html |
Created attachment 520190 [details] patch and spec file diff for selinux-policy-3.7.19-55.el6 SRPM Description of problem: selinux-policy preventing qmail-inject / qmail-queue / sendmail from search and write to /var/qmail/queue/, among other issues. I noticed the problems because crond generated e-mail was not getting delivered, with an error message like: CROND[21591]: (root) MAIL (mailed 1290 bytes of output but got status 0x006f#012) AVC errors in audit.log: type=AVC msg=audit(1314228902.078:112210): avc: denied { search } for pid=12894 comm="qmail-queue" name="queue" dev=dm-4 ino=655368 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:qmail_spool_t:s0 tclass=dir type=AVC msg=audit(1314229501.848:112243): avc: denied { search } for pid=13193 comm="qmail-queue" name="pid" dev=dm-4 ino=655470 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:qmail_spool_t:s0 tclass=dir type=AVC msg=audit(1314239102.056:112926): avc: denied { write } for pid=946 comm="qmail-queue" name="pid" dev=dm-4 ino=655470 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=dir type=AVC msg=audit(1314245701.871:113246): avc: denied { write } for pid=21283 comm="qmail-queue" name="trigger" dev=dm-4 ino=655365 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:qmail_spool_t:s0 tclass=fifo_file type=AVC msg=audit(1314246901.535:113302): avc: denied { read } for pid=21514 comm="qmail-queue" name="owners" dev=dm-4 ino=655362 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_t:s0 tclass=lnk_file Version-Release number of selected component (if applicable): 3.7.19-54.el6 How reproducible: Always Steps to Reproduce: 1. write a cron script which sends text to stderr 2. watch /var/log/cron and note the error sending the mail Can also be reproduced by directly calling sendmail on a server with qmail as the MTA. Actual results: Using the first steps to reproduce, you'll see an error similar to this in /var/log/cron: CROND[21591]: (root) MAIL (mailed 1290 bytes of output but got status 0x006f#012) Expected results: Cron mail should get delivered by qmail, as well as any mail invoked via qmail's replacement sendmail command. Additional info: Attached is a patch to the selinux-policy SRPM, including spec file diff. Basically, it does the following: 1. change file context of /var/qmail/owners(/.*)? to qmail_etc_t 2. allow processes of scontext system_mail_t read, write, search access to files, dirs, and fifos of tcontext qmail_spool_t Let me know if this policy change poses any security issues or could be implemented a different way, as I'm rather new to SElinux policy. Also note, this bug may also exist in RHEL 5, as Dan Walsh requested that I submit it under RHEL5 on the fedora-selinux mailing list. I'm only submitting under RHEL6 since that's where I observed it.