Description of problem: I'm not sure if this issue belongs to selinux-policy package or cyrus-imapd package. cyrus-imapd executables (particulary "master") have incorrect selinux labels. It happened because contents of /usr/lib/cyrus-imapd was moved to /usr/libexec/cyrus-imapd and the name of "cyrus-master" executable was changed to "master". Selinux policy still expects old location and file name. Please decide, whether files should go to /usr/lib or /usr/libexec and what names they should have or whether selinux policy should be updated.
Hi Jason, I suppose it was done on purpose and we have to ask selinux guys to adjust policy. Right? https://src.fedoraproject.org/rpms/cyrus-imapd/c/213ef748ce7bdf5f0b92c5ddbb66eeeb357bbf69?branch=master
Yes, with 3.0 upstream moved several of the files around (actually dropping some of the configure options we used to pass to set up the old layout, which is documented in the spec). Our current layout matches what upstream suggested to me during my discussions with them. They will probably reorganize again and rename more files for 3.2, but that's still in the far future. I would certainly think it worse to break with upstream than break with the selinux policy (which probably wouldn't have worked as is with 3.0 even if I found some way to avoid moving some files). Unfortunately the central selinux policy isn't something that regular packagers can maintain. We could do a few things: * Ask that cyrus be dropped from the central policy so that we can maintain it (assuming that we can figure out how to do that, since I certainly don't know) * See if it is possible to somehow patch the policy in the cyrus package. * Get the policy maintainers to fix things. The default (and or some time the only) option is the third one; just punt selinux bugs over to the policy package. There is some motion afoot to encourage packagers to maintain their own policies, though, and it might be nice to keep up with that. (I have to do so anyway since I'm on the Packaging Committee.) The problem is that I have no time to learn how to write selinux policy at the moment.
This is all I neded to change in the selinux policy to have working mail system (postfix talks to cyrus through lmtp socket): File context: /usr/libexec/cyrus-imapd/master -- gen_context(system_u:object_r:cyrus_exec_t,s0) Local policy: require { type init_t; type system_dbusd_var_run_t; type cyrus_t; type cyrus_var_lib_t; type system_dbusd_t; type sasldb_t; type cyrus_var_run_t; type postfix_smtp_t; type postfix_local_t; class file { getattr map open read }; class capability dac_override; class sock_file write; class dbus send_msg; class dir search; } #============= cyrus_t ============== allow cyrus_t cyrus_var_lib_t:file map; allow cyrus_t init_t:dbus send_msg; allow cyrus_t sasldb_t:file { getattr open read }; allow cyrus_t self:capability dac_override; allow cyrus_t system_dbusd_t:dbus send_msg; allow cyrus_t system_dbusd_var_run_t:sock_file write; allow cyrus_t init_t:file { open read }; #============= init_t ============== allow init_t cyrus_t:dbus send_msg; allow cyrus_t init_t:dir search; allow init_t postfix_local_t:dbus send_msg; #============= postfix_local_t ============== allow postfix_local_t init_t:dbus send_msg; #============= postfix_smtp_t ============== allow postfix_smtp_t cyrus_var_run_t:sock_file write;
All lines mentioning sasldb_t are only for my own purposes and are not needed for general use.
selinux-policy-3.14.1-29.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-a74875b364
selinux-policy-3.14.1-29.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-a74875b364
selinux-policy-3.14.1-29.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.