Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: I noticed the problem, because SETroubleshoot reported the following problem: ## Selinux output SELinux is preventing esmtp from read access on the file /.esmtp_queue/QSV9iiNz/mail. ***** Plugin restorecon (99.5 confidence) suggests ************************ If you want to fix the label. /.esmtp_queue/QSV9iiNz/mail default label should be default_t. Then you can run restorecon. Do # /sbin/restorecon -v /.esmtp_queue/QSV9iiNz/mail ***** Plugin catchall (1.49 confidence) suggests ************************** If you believe that esmtp should be allowed read access on the mail file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep esmtp /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:system_mail_t:s0-s0:c0.c1023 Target Context system_u:object_r:root_t:s0 Target Objects /.esmtp_queue/QSV9iiNz/mail [ file ] Source esmtp Source Path esmtp Port <Unknown> Host L420 Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-128.1.fc22.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name L420 Platform Linux L420 4.0.4-303.fc22.x86_64 #1 SMP Thu May 28 12:37:06 UTC 2015 x86_64 x86_64 Alert Count 16 First Seen 2015-06-18 15:00:06 CEST Last Seen 2015-06-18 15:01:22 CEST Local ID 1f2a2171-2ee9-4e2b-b04e-47aa3fc2e30d Raw Audit Messages type=AVC msg=audit(1434632482.148:658): avc: denied { read } for pid=8519 comm="esmtp" path="/.esmtp_queue/QSV9iiNz/mail" dev="sda6" ino=2752568 scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=file permissive=0 Hash: esmtp,system_mail_t,root_t,file,read ## End Selinux Output The content of a sample mail from /.esmtp_queue/05TFr11W/mail is ## Mail Content From: "(Cron Daemon)" <root> To: root Subject: Cron <root@L420> /usr/share/clamav/freshclam-sleep Content-Type: text/plain; charset=UTF-8 Auto-Submitted: auto-generated Precedence: bulk X-Cron-Env: <LANG=en_GB.UTF-8> X-Cron-Env: <MAILTO=root> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> WARNING: update of clamav database is disabled; please see '/etc/sysconfig/freshclam' for information how to enable the periodic update resp. how to turn off this message. ## End Mail Output Version-Release number of selected component (if applicable): clamav-update-0.98.7-1.fc22.x86_64 How reproducible: Always Steps to Reproduce: 1. Install clamav and clamav-update 2. Don't configure anything concerning updates in /etc/sysconfig/freshclam Actual results: Mails are tried to be sent and stored in /.esmtp_queue because of selinux issues Expected results: Mails are sent to root, perhaps some logs are written. Additional info: I removed the REMOVE ME Lines in /etc/sysconfig/freshclam and expect it to auto update itself now. However, /.esmtp_queue seems to be a weird path for the queue nonetheless, so I decided to report that issue.
This would be either an esmtp issue or a selinux-policy issue. I don't see how it's a clamav issue given that clamav only calls sendmail, which can be any MTA you happen to have configured. clamav doesn't create the directory in question, nor is any clamav-related context referenced in the selinux report. I think the problem here is that when configured to queue mail, esmtp will try to use the caller's $HOME for queueing, which is probably not a good idea for the root user. It should probably use some selinux-acceptable location in /var. Reassigning to esmtp.
*** This bug has been marked as a duplicate of bug 1149164 ***