Bug 1264938 - SELinux is preventing /usr/sbin/postdrop from write access on the file /tmp/logcheck.debug
SELinux is preventing /usr/sbin/postdrop from write access on the file /tmp/l...
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
x86_64 Linux
unspecified Severity high
: rc
: ---
Assigned To: Miroslav Grepl
Milos Malik
Depends On:
  Show dependency treegraph
Reported: 2015-09-21 13:08 EDT by Brian J. Murrell
Modified: 2015-10-01 05:13 EDT (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2015-10-01 05:13:32 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Brian J. Murrell 2015-09-21 13:08:55 EDT
SELinux is preventing /usr/sbin/postdrop from write access on the file /tmp/logcheck.debug.

*****  Plugin leaks (86.2 confidence) suggests   *****************************

If you want to ignore postdrop trying to write access the logcheck.debug file, because you believe it should not need this access.
Then you should report this as a bug.
You can generate a local policy module to dontaudit this access.
# grep /usr/sbin/postdrop /var/log/audit/audit.log | audit2allow -D -M mypol
# semodule -i mypol.pp

*****  Plugin catchall (14.7 confidence) suggests   **************************

If you believe that postdrop should be allowed write access on the logcheck.debug file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
allow this access for now by executing:
# grep postdrop /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:postfix_postdrop_t:s0-s0:c0.c102
Target Context                system_u:object_r:logwatch_tmp_t:s0
Target Objects                /tmp/logcheck.debug [ file ]
Source                        postdrop
Source Path                   /usr/sbin/postdrop
Port                          <Unknown>
Host                          server.interlinx.bc.ca
Source RPM Packages           postfix-2.10.1-6.el7.x86_64
Target RPM Packages
Policy RPM                    selinux-policy-3.13.1-23.el7_1.17.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     server.interlinx.bc.ca
Platform                      Linux server.interlinx.bc.ca
                              3.10.0-229.11.1.el7.x86_64 #1 SMP Thu Aug 6
                              01:06:18 UTC 2015 x86_64 x86_64
Alert Count                   29
First Seen                    2015-09-17 05:20:07 EDT
Last Seen                     2015-09-21 12:02:56 EDT
Local ID                      de291460-8d3b-4a9a-a763-78b123f6db5a

Raw Audit Messages
type=AVC msg=audit(1442851376.473:13157): avc:  denied  { write } for  pid=20139 comm="postdrop" path="/tmp/logcheck.debug" dev="dm-4" ino=65069 scontext=system_u:system_r:postfix_postdrop_t:s0-s0:c0.c1023 tcontext=system_u:object_r:logwatch_tmp_t:s0 tclass=file

type=SYSCALL msg=audit(1442851376.473:13157): arch=x86_64 syscall=execve success=yes exit=0 a0=7f164703d370 a1=7f164703d3a0 a2=7f164703c290 a3=fe items=0 ppid=20138 pid=20139 auid=993 uid=993 gid=991 euid=993 suid=993 fsuid=993 egid=90 sgid=90 fsgid=90 tty=(none) ses=171 comm=postdrop exe=/usr/sbin/postdrop subj=system_u:system_r:postfix_postdrop_t:s0-s0:c0.c1023 key=(null)

Hash: postdrop,postfix_postdrop_t,logwatch_tmp_t,file,write
Comment 1 Miroslav Grepl 2015-09-30 03:40:19 EDT
Could you describe your steps to reproduce it?
Comment 2 Brian J. Murrell 2015-09-30 12:13:57 EDT
Interesting that you should make me want to audit what I have done.

I did add some debugging to /usr/sbin/logcheck which was probably causing this.  I have disabled that and we will see if it goes away.


So yes, removing that debugging hook fixed it.

I guess I didn't think about this debugging that I added immediately because SELinux was saying that it was postdrop trying to access the debugging file when of course it was logcheck that I added the file do.  Didn't draw the (strange) connection.
Comment 3 Miroslav Grepl 2015-10-01 05:13:32 EDT
AVC shows me there is probably a redirection and I don't see why postdrop should access /tmp/logcheck.debug in a common configuration.

This is a reason why I asked you for more details.

Thank you.

Note You need to log in before you can comment on or make changes to this bug.