Bug 120912 - crond will ignore mailman crontab in SELinux enforcing mode if mailman was installed in a non-SELinux configuration
crond will ignore mailman crontab in SELinux enforcing mode if mailman was in...
Product: Fedora
Classification: Fedora
Component: mailman (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: John Dennis
Depends On:
  Show dependency treegraph
Reported: 2004-04-15 01:55 EDT by Nalin Dahyabhai
Modified: 2007-11-30 17:10 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2004-08-09 19:15:17 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Nalin Dahyabhai 2004-04-15 01:55:08 EDT
Description of problem:
The SELinux policy doesn't allow crond to read unlabeled files.  This
means that on a system which was not running an SELinux kernel (or
which was, but had SELinux disabled) when mailman was installed, the
crontab (which would be installed unlabeled) will be ignored.

Version-Release number of selected component (if applicable):

How reproducible:
Every time.

Steps to Reproduce:
1. Boot with selinux=0
2. Install mailman
3. Reboot with selinux=1 enforcing=1, relabeling if necessary
Actual results:
Audit messages indicating that crond couldn't read mailman's crontab

Expected results:
No audit messages, mailman cron jobs running.

Additional info:
crond supports reading system cron jobs from files stored in
/etc/cron.d.  If we installed the mailman crontab there instead, it
could be included directly in the package payload (and tracked by
RPM), plus we wouldn't need to run crontab in %post.  The format is a
little different, but it can be produced at build-time with little
Comment 2 John Dennis 2004-08-09 19:15:17 EDT
fixed as of mailman-2.1.5-10, crontab is no longer used, instead we
install a cron script in /etc/cron.d

Note You need to log in before you can comment on or make changes to this bug.