Description of problem: dovecot-lda, when configured as the local delivery agent for sendmail, needs both setuid and setgid capability. This resolves it: module dovecot-lda 1.0; require { type dovecot_deliver_t; class capability { setgid setuid }; } #============= dovecot_deliver_t ============== #!!!! This avc is allowed in the current policy allow dovecot_deliver_t self:capability setgid; allow dovecot_deliver_t self:capability setuid; If you need instructions on setting up dovecot-lda as the delivery agent for sendmail so you can see the problem for yourself, please ask.
Thank you for reporting the issue. I created a PR to address the issue: https://github.com/fedora-selinux/selinux-policy-contrib/pull/109 Are these capabilities required only in F30?
No, it applies to all versions of Fedora. I've personally ran into it on F29 and F30. It also applies to EL7 and EL8.
selinux-policy-3.14.3-37.fc30 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-40c077f70d
selinux-policy-3.14.3-37.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-40c077f70d
selinux-policy-3.14.3-37.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report.