Bug 768065

Summary:	Incorrect labeling on files from perl-Razor-Agent
Product:	Red Hat Enterprise Linux 6	Reporter:	Brett Lentz <blentz>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	low	Docs Contact:
Priority:	low
Version:	6.2	CC:	dwalsh, jrieden, mmalik
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.7.19-149.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-06-20 12:29:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Brett Lentz 2011-12-15 16:48:23 UTC

Description of problem:

When running Postfix + Amavis + Spamassassin on RHEL6, restorecon reports these mislabeled files:

# restorecon -R -v -n /usr/bin
restorecon reset /usr/bin/razor-admin context system_u:object_r:spamc_exec_t:s0->system_u:object_r:razor_exec_t:s0
restorecon reset /usr/bin/razor-revoke context system_u:object_r:spamc_exec_t:s0->system_u:object_r:razor_exec_t:s0
restorecon reset /usr/bin/razor-client context system_u:object_r:spamc_exec_t:s0->system_u:object_r:razor_exec_t:s0
restorecon reset /usr/bin/razor-report context system_u:object_r:spamc_exec_t:s0->system_u:object_r:razor_exec_t:s0
restorecon reset /usr/bin/razor-check context system_u:object_r:spamc_exec_t:s0->system_u:object_r:razor_exec_t:s0

However, if I tell restorecon to relabel these files (i.e. remove the -n flag from the previous command), the files are immediately relabeled from razor_exec_t to spamc_exec_t.

It appears that either Amavis or Spamassassin is enforcing the labeling.

Version-Release number of selected component (if applicable):

# rpm -q selinux-policy
selinux-policy-3.7.19-126.el6_2.3.noarch

How reproducible:

Every time.

Steps to Reproduce:
1. Install/Configure amavisd-new (From EPEL) and install/configure Spamassassin
2. Start amavisd and spamd
3. Check labeling on the files in /usr/bin, try to fix the labels.

Additional Information:

I'm not sure if the correct fix is to change the selinux policy or to fix the applications.

It should also be noted that this mislabeling doesn't appear to be breaking anything. Our monitoring system is just watching for mislabeled files and alerted us to this issue.

Comment 2 Daniel Walsh 2011-12-15 18:42:41 UTC

This is happening because spamc_exec_t and razor_exec_t are alias files.

In order to fix this we really need to eliminate the razor.pp file altogether and just ship the file context in spamassassin.pp like we have in F17.

Comment 3 Miroslav Grepl 2011-12-16 08:43:30 UTC

Yes.

Comment 8 Miroslav Grepl 2012-05-08 18:24:38 UTC

Fixed in selinux-policy-3.7.19-149.el6

Comment 11 errata-xmlrpc 2012-06-20 12:29:50 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0780.html