Bug 786597

Summary:	munin_mail_plugin_t is denied searching in /var/lib
Product:	Red Hat Enterprise Linux 6	Reporter:	Jan Kundrát <jkt>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Michal Trunecka <mtruneck>
Severity:	low	Docs Contact:
Priority:	low
Version:	6.1	CC:	dwalsh, ebenes, mmalik, sander
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.7.19-140.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-06-20 12:30:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Kundrát 2012-02-01 21:08:54 UTC

Description of problem:

The selinux policy for the mail-related munin plugins prevents them from accessing /var/lib at all. However, the postfix_mailstats plugin saves its state in /var/lib/munin/plugin-state/munin-plugin-postfix_mailstats.state, and hence has to be able to traverse the /var/lib in order to get there.

Version-Release number of selected component (if applicable):

munin-node-1.4.6-4.el6.2.noarch (EPEL)
selinux-policy-3.7.19-126.el6_2.4.noarch
selinux-policy-targeted-3.7.19-126.el6_2.4.noarch

How reproducible:

Always (as long as selinux is set to the enforcing mode).

Steps to Reproduce:
1) Install munin-node-1.4.6-4.el6.2.noarch from EPEL on a machine with SELinux enabled
2) Enable the /usr/share/munin/plugins/postfix_mailstats plugin
3) Observe that the plugin fails
4) As an added bonus to make debugging harder, note that the policy sets the denials to not be logged at all.
  
Additional info:

Thanks to Dominick Grift (grift) on IRC for his tremendous help in debugging this.

This is a sample policy which fixes this issue (as written by him):

policy_module(mymunin, 1.0.0) optional_policy(` gen_require(` type munin_mail_plugin_t; ') files_search_var_lib(munin_mail_plugin_t)')

Comment 2 Miroslav Grepl 2012-02-02 08:26:33 UTC

This is fixed in the latest RHEL6.3 policy where we have

files_search_var_lib(munin_plugin_domain)

You can download this policy from

http://people.redhat.com/dwalsh/SELinux/RHEL6/noarch/

Comment 5 Miroslav Grepl 2012-03-02 15:00:21 UTC

*** Bug 799266 has been marked as a duplicate of this bug. ***

Comment 7 errata-xmlrpc 2012-06-20 12:30:52 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0780.html