Bug 1595328 - various postfix* processes trigger SELinux denials with { map }
Summary: various postfix* processes trigger SELinux denials with { map }
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.6
Hardware: All
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-06-26 15:54 UTC by Milos Malik
Modified: 2018-10-30 10:06 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-10-30 10:05:54 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3111 None None None 2018-10-30 10:06:24 UTC

Description Milos Malik 2018-06-26 15:54:24 UTC
Description of problem:

Version-Release number of selected component (if applicable):
postfix-2.10.1-7.el7.x86_64
selinux-policy-3.13.1-204.el7.noarch
selinux-policy-devel-3.13.1-204.el7.noarch
selinux-policy-doc-3.13.1-204.el7.noarch
selinux-policy-minimum-3.13.1-204.el7.noarch
selinux-policy-mls-3.13.1-204.el7.noarch
selinux-policy-sandbox-3.13.1-204.el7.noarch
selinux-policy-targeted-3.13.1-204.el7.noarch

How reproducible:
 * always

Steps to Reproduce:
1. get a RHEL-7.6 machine (targeted policy is active)
2. run following automated TC:
 * /CoreOS/selinux-policy/Regression/bz719261-SELinux-policy-forbidds-resending-of-queued
3. search for SELinux denials

Actual results:
----
type=PROCTITLE msg=audit(06/26/2018 02:59:07.560:86) : proctitle=(null) 
type=PATH msg=audit(06/26/2018 02:59:07.560:86) : item=1 name=/lib64/ld-linux-x8
6-64.so.2 inode=313037 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 ob
j=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 c
ap_fver=0 
type=PATH msg=audit(06/26/2018 02:59:07.560:86) : item=0 name=/usr/libexec/postfix/smtp inode=983522 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:postfix_smtp_exec_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=CWD msg=audit(06/26/2018 02:59:07.560:86) :  cwd=/var/spool/postfix 
type=SYSCALL msg=audit(06/26/2018 02:59:07.560:86) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0x562e563a9540 a1=0x562e563a98b0 a2=0x562e563a2f60 a3=0xffffffff items=2 ppid=1400 pid=1413 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=smtp exe=/usr/libexec/postfix/smtp subj=system_u:system_r:postfix_master_t:s0 key=(null) 
type=AVC msg=audit(06/26/2018 02:59:07.560:86) : avc:  denied  { map } for  pid=1413 comm=smtp path=/usr/libexec/postfix/smtp dev="dm-0" ino=983522 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:postfix_smtp_exec_t:s0 tclass=file permissive=0 
----
type=PROCTITLE msg=audit(06/26/2018 04:00:42.518:271) : proctitle=(null) 
type=PATH msg=audit(06/26/2018 04:00:42.518:271) : item=1 name=/lib64/ld-linux-x
86-64.so.2 inode=313037 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 o
bj=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 
cap_fver=0 
type=PATH msg=audit(06/26/2018 04:00:42.518:271) : item=0 name=/usr/sbin/postdrop inode=587060 dev=fd:00 mode=file,sgid,755 ouid=root ogid=postdrop rdev=00:00 obj=system_u:object_r:postfix_postdrop_exec_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=CWD msg=audit(06/26/2018 04:00:42.518:271) :  cwd=/var/spool/postfix 
type=SYSCALL msg=audit(06/26/2018 04:00:42.518:271) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0x55597ef8c390 a1=0x55597ef8c3c0 a2=0x55597ef8b560 a3=0x2 items=2 ppid=983 pid=986 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=postdrop exe=/usr/sbin/postdrop subj=system_u:system_r:sendmail_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(06/26/2018 04:00:42.518:271) : avc:  denied  { map } for  pid=986 comm=postdrop path=/usr/sbin/postdrop dev="dm-0" ino=587060 scontext=system_u:system_r:sendmail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:postfix_postdrop_exec_t:s0 tclass=file permissive=0 
----
type=PROCTITLE msg=audit(06/26/2018 11:46:17.804:343) : proctitle=(null) 
type=PATH msg=audit(06/26/2018 11:46:17.804:343) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=313037 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=PATH msg=audit(06/26/2018 11:46:17.804:343) : item=0 name=/usr/libexec/postfix/showq inode=587049 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:postfix_showq_exec_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=CWD msg=audit(06/26/2018 11:46:17.804:343) :  cwd=/var/spool/postfix 
type=SYSCALL msg=audit(06/26/2018 11:46:17.804:343) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0x555adaa6db90 a1=0x555adaa6ddf0 a2=0x555adaa66f50 a3=0xffffffff items=2 ppid=18911 pid=24771 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=showq exe=/usr/libexec/postfix/showq subj=system_u:system_r:postfix_master_t:s0 key=(null) 
type=AVC msg=audit(06/26/2018 11:46:17.804:343) : avc:  denied  { map } for  pid=24771 comm=showq path=/usr/libexec/postfix/showq dev="dm-0" ino=587049 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:postfix_showq_exec_t:s0 tclass=file permissive=0 
----
type=PROCTITLE msg=audit(06/26/2018 11:46:17.805:342) : proctitle=(null) 
type=PATH msg=audit(06/26/2018 11:46:17.805:342) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=313037 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=PATH msg=audit(06/26/2018 11:46:17.805:342) : item=0 name=/usr/libexec/postfix/cleanup inode=587028 dev=fd:00 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:postfix_cleanup_exec_t:s0 objtype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=CWD msg=audit(06/26/2018 11:46:17.805:342) :  cwd=/var/spool/postfix 
type=SYSCALL msg=audit(06/26/2018 11:46:17.805:342) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0x555adaa6b140 a1=0x555adaa6b6d0 a2=0x555adaa66f50 a3=0xffffffff items=2 ppid=18911 pid=24770 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=cleanup exe=/usr/libexec/postfix/cleanup subj=system_u:system_r:postfix_master_t:s0 key=(null) 
type=AVC msg=audit(06/26/2018 11:46:17.805:342) : avc:  denied  { map } for  pid=24770 comm=cleanup path=/usr/libexec/postfix/cleanup dev="dm-0" ino=587028 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:postfix_cleanup_exec_t:s0 tclass=file permissive=0 
----

Expected results:
 * no SELinux denials

Comment 4 errata-xmlrpc 2018-10-30 10:05:54 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3111


Note You need to log in before you can comment on or make changes to this bug.