Description of problem: Dovecot can search for users and accounts via ldap. To do this with TLS, it's common to reference the certificates in /etc/ldap/certs. Alternately, ldap library defaults in /etc/ldap/ldap.conf can affect the usage of TLS and certificates. As a result, dovecot get's denials reading these certificates. The following addition to policy/modules/contrib/dovecot.te would correct this. ldap_read_certs(dovecot_auth_t) Alternately, sysnet_use_ldap lists in a comment that for LDAPS it enables some access to rand/urand. Perhaps the addition of ldap_read_certs($1) to policy/modules/system/sysnetwork.if would be a useful addition, as sysnet_use_ldap would grant access to all resources for "tls/ssl" access to ldap.
I like the second option. commit a330d66d2dfe23312f1911e3210fc63fa9e9d3ec fixes this in git.
Does this mean the server slapd process private keys are leaked via this? How are they labeled?
I added changes to F19. Sorry but I don't understand your question, we just allow ldap to read certs. What leaked? You mean how are labeled certs? $ matchpathcon /etc/openldap/certs /etc/openldap/certs system_u:object_r:slapd_cert_t:s0
selinux-policy-3.12.1-74.29.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-74.29.fc19
Package selinux-policy-3.12.1-74.29.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-74.29.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-9432/selinux-policy-3.12.1-74.29.fc19 then log in and leave karma (feedback).
selinux-policy-3.12.1-74.30.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-74.30.fc19
selinux-policy-3.12.1-74.30.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.