Bug 1530275 - Postfix generates AVCs when looking up unknown users
Summary: Postfix generates AVCs when looking up unknown users
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 27
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-01-02 12:34 UTC by Gustavo Maciel Dias Vieira
Modified: 2018-02-06 15:31 UTC (History)
5 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2018-02-06 15:31:34 UTC


Attachments (Terms of Use)

Description Gustavo Maciel Dias Vieira 2018-01-02 12:34:41 UTC
Description of problem:

AVCs are generated when Postfix looks up unknown users. The AVCs are not generated for existing users.

Version-Release number of selected component (if applicable):
postfix-3.2.4-1.fc27.x86_64
selinux-policy-3.13.1-283.17.fc27.noarch


How reproducible:
Deterministic

Steps to Reproduce:
1. Setup Postfix. I don't believe my setup is unusual in any way.
2. Sent a email to an unknown user
3.

Additional info:

AVCs:
type=AVC msg=audit(1514891673.188:231): avc:  denied  { write } for  pid=1354 comm="proxymap" name="system_bus_socket" dev="tmpfs" ino=19647 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:system_dbusd_var_run_t:s0 tclass=sock_file permissive=1
type=USER_AVC msg=audit(1514891673.192:232): pid=542 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.DBus member=Hello dest=org.freedesktop.DBus spid=1354 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1514891673.193:233): pid=542 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.systemd1.Manager member=LookupDynamicUserByName dest=org.freedesktop.systemd1 spid=1354 tpid=1 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1514891673.194:234): pid=542 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=error error_name=org.freedesktop.systemd1.NoSuchDynamicUser dest=:1.13 spid=1 tpid=1354 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:postfix_master_t:s0 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'

audit2allow:

#============= init_t ==============
allow init_t postfix_master_t:dbus send_msg;

#============= postfix_master_t ==============
allow postfix_master_t init_t:dbus send_msg;
allow postfix_master_t system_dbusd_t:dbus send_msg;
allow postfix_master_t system_dbusd_var_run_t:sock_file write;

Comment 1 Gustavo Maciel Dias Vieira 2018-01-15 21:15:18 UTC
Got more AVCs, this ones are generated when the message with the invalid user is created locally:

type=AVC msg=audit(1516050518.457:467): avc:  denied  { write } for  pid=4916 comm="local" name="system_bus_socket" dev="tmpfs" ino=19766 scontext=system_u:system_r:postfix_local_t:s0 tcontext=system_u:object_r:system_dbusd_var_run_t:s0 tclass=sock_file permissive=1
type=USER_AVC msg=audit(1516050518.458:468): pid=554 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.DBus member=Hello dest=org.freedesktop.DBus spid=4916 scontext=system_u:system_r:postfix_local_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1516050518.459:469): pid=554 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.systemd1.Manager member=LookupDynamicUserByName dest=org.freedesktop.systemd1 spid=4916 tpid=1 scontext=system_u:system_r:postfix_local_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1516050518.460:470): pid=554 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=error error_name=org.freedesktop.systemd1.NoSuchDynamicUser dest=:1.41 spid=1 tpid=4916 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:postfix_local_t:s0 tclass=dbus permissive=1  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'


Adding this to the rest, audit2allow gives:

#============= init_t ==============
allow init_t postfix_local_t:dbus send_msg;
allow init_t postfix_master_t:dbus send_msg;

#============= postfix_local_t ==============
allow postfix_local_t init_t:dbus send_msg;
allow postfix_local_t system_dbusd_t:dbus send_msg;
allow postfix_local_t system_dbusd_var_run_t:sock_file write;

#============= postfix_master_t ==============
allow postfix_master_t init_t:dbus send_msg;
allow postfix_master_t system_dbusd_t:dbus send_msg;
allow postfix_master_t system_dbusd_var_run_t:sock_file write;

Comment 2 Fedora Update System 2018-01-30 16:41:23 UTC
selinux-policy-3.13.1-283.24.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-a144eca5a8

Comment 3 Fedora Update System 2018-01-31 22:45:00 UTC
selinux-policy-3.13.1-283.24.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-a144eca5a8

Comment 4 Fedora Update System 2018-02-06 15:31:34 UTC
selinux-policy-3.13.1-283.24.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.