Bug 1233227 - clamav wants to send mails and uses /.esmtp_queue which is prevented by selinux
Summary: clamav wants to send mails and uses /.esmtp_queue which is prevented by selinux
Keywords:
Status: CLOSED DUPLICATE of bug 1149164
Alias: None
Product: Fedora
Classification: Fedora
Component: esmtp
Version: 22
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Steven M. Parrish
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-06-18 13:32 UTC by Sascha Zantis
Modified: 2015-09-17 19:28 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2015-09-17 19:28:16 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Sascha Zantis 2015-06-18 13:32:26 UTC
Description of problem:
I noticed the problem, because SETroubleshoot reported the following problem: 

## Selinux output

SELinux is preventing esmtp from read access on the file /.esmtp_queue/QSV9iiNz/mail.

*****  Plugin restorecon (99.5 confidence) suggests   ************************

If you want to fix the label. 
/.esmtp_queue/QSV9iiNz/mail default label should be default_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /.esmtp_queue/QSV9iiNz/mail

*****  Plugin catchall (1.49 confidence) suggests   **************************

If you believe that esmtp should be allowed read access on the mail file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep esmtp /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:system_mail_t:s0-s0:c0.c1023
Target Context                system_u:object_r:root_t:s0
Target Objects                /.esmtp_queue/QSV9iiNz/mail [ file ]
Source                        esmtp
Source Path                   esmtp
Port                          <Unknown>
Host                          L420
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-128.1.fc22.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     L420
Platform                      Linux L420 4.0.4-303.fc22.x86_64 #1 SMP Thu May 28
                              12:37:06 UTC 2015 x86_64 x86_64
Alert Count                   16
First Seen                    2015-06-18 15:00:06 CEST
Last Seen                     2015-06-18 15:01:22 CEST
Local ID                      1f2a2171-2ee9-4e2b-b04e-47aa3fc2e30d

Raw Audit Messages
type=AVC msg=audit(1434632482.148:658): avc:  denied  { read } for  pid=8519 comm="esmtp" path="/.esmtp_queue/QSV9iiNz/mail" dev="sda6" ino=2752568 scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=file permissive=0


Hash: esmtp,system_mail_t,root_t,file,read

## End Selinux Output


The content of a sample mail from /.esmtp_queue/05TFr11W/mail is 

## Mail Content

From: "(Cron Daemon)" <root>
To: root
Subject: Cron <root@L420> /usr/share/clamav/freshclam-sleep
Content-Type: text/plain; charset=UTF-8
Auto-Submitted: auto-generated
Precedence: bulk
X-Cron-Env: <LANG=en_GB.UTF-8>
X-Cron-Env: <MAILTO=root>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>

WARNING: update of clamav database is disabled; please see
  '/etc/sysconfig/freshclam'
  for information how to enable the periodic update resp. how to turn
  off this message.

## End Mail Output

Version-Release number of selected component (if applicable):
clamav-update-0.98.7-1.fc22.x86_64


How reproducible:
Always


Steps to Reproduce:
1. Install clamav and clamav-update
2. Don't configure anything concerning updates in /etc/sysconfig/freshclam

Actual results:
Mails are tried to be sent and stored in /.esmtp_queue because of selinux issues

Expected results:
Mails are sent to root, perhaps some logs are written.


Additional info:
I removed the REMOVE ME Lines in /etc/sysconfig/freshclam and expect it to auto update itself now. However, /.esmtp_queue seems to be a weird path for the queue nonetheless, so I decided to report that issue.

Comment 1 Jason Tibbitts 2015-06-18 15:00:17 UTC
This would be either an esmtp issue or a selinux-policy issue.  I don't see how it's a clamav issue given that clamav only calls sendmail, which can be any MTA you happen to have configured.  clamav doesn't create the directory in question, nor is any clamav-related context referenced in the selinux report.

I think the problem here is that when configured to queue mail, esmtp will try to use the caller's $HOME for queueing, which is probably not a good idea for the root user.  It should probably use some selinux-acceptable location in /var.

Reassigning to esmtp.

Comment 2 Dan Mossor [danofsatx] 2015-09-17 19:28:16 UTC

*** This bug has been marked as a duplicate of bug 1149164 ***


Note You need to log in before you can comment on or make changes to this bug.