Bug 1012651 - Policy prevents amavisd-new from talking to databases
Summary: Policy prevents amavisd-new from talking to databases
Keywords:
Status: CLOSED NEXTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.4
Hardware: Unspecified
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-09-26 19:28 UTC by Chris Adams
Modified: 2013-10-10 13:22 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-10-10 13:19:51 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Chris Adams 2013-09-26 19:28:48 UTC
I store amavisd-new configuration information in a MySQL database, but the SELinux policy prevents amavis_t from connecting to MySQL (amavisd-new also support PostgreSQL).

type=AVC msg=audit(1380216717.948:14804): avc:  denied  { name_connect } for  pid=22644 comm="amavisd" dest=3306 scontext=system_u:system_r:amavis_t:s0 tcontext=system_u:object_r:mysqld_port_t:s0 tclass=tcp_socket

Comment 2 Daniel Walsh 2013-09-28 10:23:42 UTC
Well in Fedora we allow amavis to connect to myqsql stream socket, so I don't see a big difference in allowing this (In latest Fedora/RHEL7 amavis domain has been consolidated into antivirus_t)

Not sure it would be worth adding a boolean for this.

Comment 3 Miroslav Grepl 2013-10-10 13:19:51 UTC
Well it has been also fixed in RHEL6.5 and we have antivirus_domain also here.

#cat /tmp/log|audit2allow


#============= amavis_t ==============

#!!!! This avc is allowed in the current policy
allow amavis_t mysqld_port_t:tcp_socket name_connect

So it will be a part of RHEL6.5 updates. You can add a local policy for now to allow it.

Comment 4 Chris Adams 2013-10-10 13:22:19 UTC
Thanks - I was already planning to add a temp local policy, and will watch for the update.


Note You need to log in before you can comment on or make changes to this bug.