Bug 753962
| Summary: | Selinux blocks mimedefang communicating with clamav | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Philip Prindeville <philipp> |
| Component: | selinux-policy-targeted | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED RAWHIDE | QA Contact: | Ben Levenson <benl> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | dwalsh, philipp |
| Target Milestone: | --- | Keywords: | Reopened, SELinux |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-12-09 08:45:43 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Hmmm... that apparently wasn't enough:
module local 1.0;
require {
type spamd_var_run_t;
type spamd_t;
type clamd_var_run_t;
type clamd_t;
class sock_file write;
class unix_stream_socket connectto;
class dir { read search open getattr };
class file { read getattr open };
}
#============= clamd_t ==============
allow clamd_t spamd_var_run_t:dir { read search open getattr };
allow clamd_t spamd_var_run_t:file { read getattr open };
#============= spamd_t ==============
allow spamd_t clamd_t:unix_stream_socket connectto;
allow spamd_t clamd_var_run_t:sock_file write;
I have no problem with this and checked in the fixes. This should be back ported to RHEL6, F15 and F16 0117b6b5c9191579de9210597511cbad489086c0 Also seeing:
[root@mail tmp]# audit2allow -m local
type=AVC msg=audit(1321446394.000:6867): avc: denied { read } for pid=28360 comm="gpg" name=".spamassassin28359K8dpY7tmp" dev=sda3 ino=526169 scontext=system_u:system_r:gpg_t:s0-s0:c0.c1023 tcontext=system_u:object_r:spamd_tmp_t:s0 tclass=file
module local 1.0;
require {
type gpg_t;
type spamd_tmp_t;
class file read;
}
#============= gpg_t ==============
allow gpg_t spamd_tmp_t:file read;
[root@mail tmp]#
and:
[root@mail tmp]# audit2allow -m local
type=AVC msg=audit(1321482565.921:6978): avc: denied { write } for pid=30589 comm="mimedefang.pl" name="clamd.sock" dev=tmpfs ino=997944 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:clamd_var_run_t:s0 tclass=sock_file
type=SYSCALL msg=audit(1321482565.921:6978): arch=c000003e syscall=42 success=no exit=-13 a0=6 a1=3a4c320 a2=6e a3=0 items=0 ppid=18474 pid=30589 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="mimedefang.pl" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
module local 1.0;
require {
type spamd_t;
type clamd_var_run_t;
class sock_file write;
}
#============= spamd_t ==============
allow spamd_t clamd_var_run_t:sock_file write;
[root@mail tmp]#
You need to update to the latest policy. (In reply to comment #4) > You need to update to the latest policy. Can you release the latest sources for F15 as well then please? (In reply to comment #5) > (In reply to comment #4) > > You need to update to the latest policy. > > Can you release the latest sources for F15 as well then please? Yes, added to selinux-policy-3.9.16-48.fc15 Even with the current policy on F16, I'm seeing problems with mimedefang not being able to connect to clamd. --------------------- Selinux Audit Begin ------------------------
*** Denials ***
system_u:system_r:spamd_t:s0 system_u:object_r:clamd_var_run_t:s0 (dir): 105 times
system_u:system_r:spamd_t:s0 system_u:object_r:sendmail_exec_t:s0 (file): 2 times
---------------------- Selinux Audit End -------------------------
(In reply to comment #6) > (In reply to comment #5) > > (In reply to comment #4) > > > You need to update to the latest policy. > > > > Can you release the latest sources for F15 as well then please? > > Yes, added to selinux-policy-3.9.16-48.fc15 Please confirm that the policy in comment #1 is present. Could you add me appropriate AVC msgs for denials from the comment #8. A new F15 policy will be available today from koji. ----
time->Tue Nov 22 12:35:36 2011
type=AVC msg=audit(1321990536.725:453): avc: denied { search } for pid=8565 comm="mimedefang.pl" name="clamd.mimedefang" dev=tmpfs ino=13416 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:clamd_var_run_t:s0 tclass=dir
----
time->Tue Nov 22 12:37:26 2011
type=AVC msg=audit(1321990646.954:455): avc: denied { search } for pid=8565 comm="mimedefang.pl" name="clamd.mimedefang" dev=tmpfs ino=13416 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:clamd_var_run_t:s0 tclass=dir
----
time->Tue Nov 22 12:37:26 2011
type=AVC msg=audit(1321990646.952:454): avc: denied { search } for pid=8565 comm="mimedefang.pl" name="clamd.mimedefang" dev=tmpfs ino=13416 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:clamd_var_run_t:s0 tclass=dir
----
time->Tue Nov 22 12:37:26 2011
type=AVC msg=audit(1321990646.955:456): avc: denied { search } for pid=8565 comm="mimedefang.pl" name="clamd.mimedefang" dev=tmpfs ino=13416 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:clamd_var_run_t:s0 tclass=dir
----
time->Tue Nov 22 12:38:35 2011
type=AVC msg=audit(1321990715.018:457): avc: denied { search } for pid=8565 comm="mimedefang.pl" name="clamd.mimedefang" dev=tmpfs ino=13416 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:clamd_var_run_t:s0 tclass=dir
----
time->Tue Nov 22 12:39:59 2011
type=AVC msg=audit(1321990799.265:458): avc: denied { search } for pid=8565 comm="mimedefang.pl" name="clamd.mimedefang" dev=tmpfs ino=13416 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:clamd_var_run_t:s0 tclass=dir
----
time->Wed Nov 23 00:07:37 2011
type=SYSCALL msg=audit(1322032057.218:572): arch=c000003e syscall=59 success=no exit=-13 a0=4791460 a1=3318330 a2=ce8070 a3=8 items=0 ppid=11441 pid=11464 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="mimedefang.pl" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
type=AVC msg=audit(1322032057.218:572): avc: denied { execute } for pid=11464 comm="mimedefang.pl" name="sendmail.sendmail" dev=sda3 ino=266985 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file
----
time->Wed Nov 23 00:07:37 2011
type=SYSCALL msg=audit(1322032057.339:573): arch=c000003e syscall=59 success=no exit=-13 a0=4791460 a1=3318330 a2=ce8070 a3=8 items=0 ppid=11441 pid=11467 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="mimedefang.pl" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
type=AVC msg=audit(1322032057.339:573): avc: denied { execute } for pid=11467 comm="mimedefang.pl" name="sendmail.sendmail" dev=sda3 ino=266985 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file
----
time->Wed Nov 23 01:01:57 2011
type=SYSCALL msg=audit(1322035317.074:583): arch=c000003e syscall=59 success=no exit=-13 a0=3bdd740 a1=4bc20d0 a2=ce8070 a3=8 items=0 ppid=11441 pid=11623 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="mimedefang.pl" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
type=AVC msg=audit(1322035317.074:583): avc: denied { execute } for pid=11623 comm="mimedefang.pl" name="sendmail.sendmail" dev=sda3 ino=266985 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file
----
time->Wed Nov 23 01:01:57 2011
type=SYSCALL msg=audit(1322035317.196:584): arch=c000003e syscall=59 success=no exit=-13 a0=3bdd740 a1=3be35e0 a2=ce8070 a3=8 items=0 ppid=11441 pid=11626 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="mimedefang.pl" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
type=AVC msg=audit(1322035317.196:584): avc: denied { execute } for pid=11626 comm="mimedefang.pl" name="sendmail.sendmail" dev=sda3 ino=266985 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file
----
So setting permissive mode, and deleting the local work-around policies, I get:
type=AVC msg=audit(1322078626.729:7740): avc: denied { write } for pid=15115 comm="mimedefang.pl" name="clamd.sock" dev=tmpfs ino=6404553 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:clamd_var_run_t:s0 tclass=sock_file
type=AVC msg=audit(1322078626.729:7740): avc: denied { connectto } for pid=15115 comm="mimedefang.pl" path="/var/run/clamd.mimedefang/clamd.sock" scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:system_r:clamd_t:s0 tclass=unix_stream_socket
type=SYSCALL msg=audit(1322078626.729:7740): arch=c000003e syscall=42 success=yes exit=0 a0=6 a1=33ff590 a2=6e a3=0 items=0 ppid=15114 pid=15115 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="mimedefang.pl" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)
type=AVC msg=audit(1322078626.730:7741): avc: denied { getattr } for pid=15148 comm="clamd" path="/var/spool/MIMEDefang/mdefang-pANK3fSD015146/Work/msg-15115-1.txt" dev=sda2 ino=1105434 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:spamd_var_run_t:s0 tclass=file
type=SYSCALL msg=audit(1322078626.730:7741): arch=c000003e syscall=6 success=yes exit=0 a0=2228c00 a1=7f756de1bb40 a2=7f756de1bb40 a3=31bdb35ba0 items=0 ppid=1 pid=15148 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="clamd" exe="/usr/sbin/clamd" subj=system_u:system_r:clamd_t:s0 key=(null)
type=AVC msg=audit(1322078626.730:7742): avc: denied { read } for pid=15148 comm="clamd" name="msg-15115-1.txt" dev=sda2 ino=1105434 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:spamd_var_run_t:s0 tclass=file
type=SYSCALL msg=audit(1322078626.730:7742): arch=c000003e syscall=21 success=yes exit=0 a0=7f7564000900 a1=4 a2=625d80 a3=0 items=0 ppid=1 pid=15148 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="clamd" exe="/usr/sbin/clamd" subj=system_u:system_r:clamd_t:s0 key=(null)
type=AVC msg=audit(1322078626.730:7743): avc: denied { open } for pid=15148 comm="clamd" name="msg-15115-1.txt" dev=sda2 ino=1105434 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:spamd_var_run_t:s0 tclass=file
type=SYSCALL msg=audit(1322078626.730:7743): arch=c000003e syscall=2 success=yes exit=11 a0=7f7564000900 a1=0 a2=7f756de1bcf0 a3=0 items=0 ppid=1 pid=15148 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="clamd" exe="/usr/sbin/clamd" subj=system_u:system_r:clamd_t:s0 key=(null)
I'll try the koji build shortly.
And after doing "yum --enablerepo=updates-testing update selinux-policy\*" :
type=MAC_POLICY_LOAD msg=audit(1322078923.274:7744): policy loaded auid=0 ses=1
type=SYSCALL msg=audit(1322078923.274:7744): arch=c000003e syscall=1 success=yes exit=4196488 a0=4 a1=7f7d03e58000 a2=400888 a3=7fffb293f4d0 items=0 ppid=15208 pid=15210 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="load_policy" exe="/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1322079000.277:7750): avc: denied { getattr } for pid=15910 comm="clamd" path="/var/spool/MIMEDefang/mdefang-pANK9sYT015908/Work/msg-15886-1.txt" dev=sda2 ino=1105448 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:spamd_var_run_t:s0 tclass=file
type=SYSCALL msg=audit(1322079000.277:7750): arch=c000003e syscall=6 success=yes exit=0 a0=1072140 a1=7f63aa706b40 a2=7f63aa706b40 a3=31bdb35ba0 items=0 ppid=1 pid=15910 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="clamd" exe="/usr/sbin/clamd" subj=system_u:system_r:clamd_t:s0 key=(null)
type=AVC msg=audit(1322079000.277:7751): avc: denied { read } for pid=15910 comm="clamd" name="msg-15886-1.txt" dev=sda2 ino=1105448 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:spamd_var_run_t:s0 tclass=file
type=SYSCALL msg=audit(1322079000.277:7751): arch=c000003e syscall=21 success=yes exit=0 a0=7f639c000900 a1=4 a2=625d80 a3=0 items=0 ppid=1 pid=15910 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="clamd" exe="/usr/sbin/clamd" subj=system_u:system_r:clamd_t:s0 key=(null)
type=AVC msg=audit(1322079000.277:7752): avc: denied { open } for pid=15910 comm="clamd" name="msg-15886-1.txt" dev=sda2 ino=1105448 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:spamd_var_run_t:s0 tclass=file
type=SYSCALL msg=audit(1322079000.277:7752): arch=c000003e syscall=2 success=yes exit=11 a0=7f639c000900 a1=0 a2=7f63aa706cf0 a3=0 items=0 ppid=1 pid=15910 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="clamd" exe="/usr/sbin/clamd" subj=system_u:system_r:clamd_t:s0 key=(null)
I'm running .60 and still seeing this on FC16. Now I'm running .61 and still seeing this on FC16. Fixed in -62 release. (In reply to comment #16) > Fixed in -62 release. Updated to -62. No longer seeing the following: ---- time->Mon Nov 28 14:26:35 2011 type=SYSCALL msg=audit(1322515595.236:9146): arch=c000003e syscall=6 success=yes exit=0 a0=10b3990 a1=7f63a9f05b40 a2=7f63a9f05b40 a3=31bdb35ba0 items=0 ppid=1 pid=16665 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="clamd" exe="/usr/sbin/clamd" subj=system_u:system_r:clamd_t:s0 key=(null) type=AVC msg=audit(1322515595.236:9146): avc: denied { getattr } for pid=16665 comm="clamd" path="/var/spool/MIMEDefang/mdefang-pASLQTid016652/Work/msg-15859-26.txt" dev=sda2 ino=1108278 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:spamd_var_run_t:s0 tclass=file ---- time->Mon Nov 28 14:26:35 2011 type=SYSCALL msg=audit(1322515595.236:9147): arch=c000003e syscall=21 success=yes exit=0 a0=7f63a0011520 a1=4 a2=625d80 a3=0 items=0 ppid=1 pid=16665 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="clamd" exe="/usr/sbin/clamd" subj=system_u:system_r:clamd_t:s0 key=(null) type=AVC msg=audit(1322515595.236:9147): avc: denied { read } for pid=16665 comm="clamd" name="msg-15859-26.txt" dev=sda2 ino=1108278 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:spamd_var_run_t:s0 tclass=file ---- time->Mon Nov 28 14:26:35 2011 type=SYSCALL msg=audit(1322515595.236:9148): arch=c000003e syscall=2 success=yes exit=11 a0=7f63a0011520 a1=0 a2=7f63a9f05cf0 a3=0 items=0 ppid=1 pid=16665 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="clamd" exe="/usr/sbin/clamd" subj=system_u:system_r:clamd_t:s0 key=(null) type=AVC msg=audit(1322515595.236:9148): avc: denied { open } for pid=16665 comm="clamd" name="msg-15859-26.txt" dev=sda2 ino=1108278 scontext=system_u:system_r:clamd_t:s0 tcontext=system_u:object_r:spamd_var_run_t:s0 tclass=file [root@mail mail]# Looks good to go. Please push to updates-testing. I'm guessing that this is addressed here: * Mon Nov 28 2011 Miroslav Grepl <mgrepl> 3.10.0-62 - Add fs_read_fusefs_dirs interface - Allow mailman to read /dev/urandom - Allow clamd to read spamd pid file - Allow mount to read /dev/urandom - Add use_fusefs_home_dirs also for system_dbus_t on the "clamd" line. We can close out this bug then? |
Description of problem: Mimedefang fails to open clamd socket. Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: No SE policy to allow communication between mimedefang and clamav. Expected results: allow spamd_t clamd_var_run_t:sock_file write; Additional info: type=AVC msg=audit(1321121780.780:3544): avc: denied { write } for pid=28494 comm="mimedefang.pl" name="clamd.sock" dev=tmpfs ino=740848 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:clamd_var_run_t:s0 tclass=sock_file type=SYSCALL msg=audit(1321121780.780:3544): arch=c000003e syscall=42 success=no exit=-13 a0=6 a1=2bf8a90 a2=6e a3=0 items=0 ppid=28493 pid=28494 auid=4294967295 uid=491 gid=478 euid=491 suid=491 fsuid=491 egid=478 sgid=478 fsgid=478 tty=(none) ses=4294967295 comm="mimedefang.pl" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null)