Bug 173957 - alias db permission denied - was file not created for root in /var/spool/mail
alias db permission denied - was file not created for root in /var/spool/mail
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
5
i686 Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2005-11-22 21:22 EST by Jim Cornette
Modified: 2007-11-30 17:11 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-01-02 11:44:20 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
delivered mail after setenforce 0 performed from root account. (81.86 KB, text/plain)
2005-11-22 21:30 EST, Jim Cornette
no flags Details
audit.log filtered for avc messages (62.55 KB, text/plain)
2005-11-22 22:06 EST, Jim Cornette
no flags Details

  None (edit)
Description Jim Cornette 2005-11-22 21:22:55 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.12) Gecko/20051018 Fedora/1.7.12-2

Description of problem:
After installing from development during the 11/19 timeframe. (files on boot.iso were dated 11/19), I noticed that the  mail from root was not being delivered. I also noted trouble with getting messages which left me in the same directory when using 'su -' in gnome terminal. Also running newaliases as root gave errors in the system logs.
running 'setenforce 0' allowed me to get mail from root. I could also send mail to accounts. After changing the file for user1 to get root mail and running newaliases, a few messages came to the user1 account describing the problems encountered.

I'll attach logs after posting submitted for mail and audit.log


Version-Release number of selected component (if applicable):
selinux-policy-targeted-1.27.2-19

How reproducible:
Always

Steps to Reproduce:
1. login to computer with SELinux targeted active.
2. check local mail, nothing available. Notice error when launching mutt which stated that /var/spool/mail/root could not be created.
3. from gnome-terminal, running 'su -' produces errors about not being able to change to /root directory. Typing cd after the error changes the PWD to /root and does not display errors.
4. Running pup or system-config-* tools from the root terminals fail to operate. 
5. run 'setenforce 0' and try the actions above. 

Actual Results:  1. things looked ok through the GUI (GNOME)
2.No mail was available for root and mail sent through the program 'mail' ever arrived for root or for user1.
3. errors displayed and the directory that was PWD remained, 'su -' did not change  to /root directory.
4. The tools did not work as root from gnome-terminal. Running these tools in user1 account prompted for a password and worked after entering the password for root.
5.After 'setenforce 0', I did not have errors displayed when 'su -' from a gnome-terminal performed. pup launched from the root (su - from user1) gnome terminal. Mail started showing up from local accounts. Messages for root showed undeliverable errors.

Expected Results:  Expectec mail to arrive, programs launched from an 'su -' gnome terminal to work as before. Expected the su- command to change me to the /root directory without giving errors.

Additional info:

I posted this message on fedora-test list before realizing that setenforce 0 would prevent errors as described above.

https://www.redhat.com/archives/fedora-test-list/2005-November/msg00412.html

Marked as severe since it prevents data from making it to disk, change if inapropriate.
Comment 1 Jim Cornette 2005-11-22 21:30:27 EST
Created attachment 121382 [details]
delivered mail after setenforce 0 performed from root account.

These messages were from the system mostly.
Comment 2 Jim Cornette 2005-11-22 22:06:28 EST
Created attachment 121384 [details]
audit.log filtered for avc messages

These messages relate to my problems with mail and other problems.
Comment 3 Jim Cornette 2005-11-25 18:59:14 EST
After installing fresh with discs for FC5T1, the below symptoms showed up in
maillog.

cornette-lt sendmail[2058] NOQUEUE: SYSERR(root): db_map_open: cannot pre-open
database /etc/aliases.db: Permission denied
cornette-lt sendmail[2058] NOQUEUE: SYSERR(root): Cannot create database for
alias file /etc/aliases
cornette-lt sendmail[2063] starting daemon (8.13.5): SMTP+queueing@01:00:00
cornette-lt sm-msp-queue[2070] starting daemon (8.13.5): queueing@01:00:00
cornette-lt sendmail[3775] jAP8IhNl003775: from=root, size=1116, class=0,
nrcpts=1, msgid=<200511250818.jAP8IhNl003775@localhost.localdomain>,
relay=root@localhost
cornette-lt sendmail[3776] jAP8Ihhv003776: from=<root@localhost.localdomain>,
size=1422, class=0, nrcpts=1,
msgid=<200511250818.jAP8IhNl003775@localhost.localdomain>, proto=ESMTP,
daemon=MTA, relay=cornette-lt [127.0.0.1]
cornette-lt sendmail[3775] jAP8IhNl003775: to=root, ctladdr=root (0/0),
delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=31116, relay=[127.0.0.1]
[127.0.0.1], dsn=2.0.0, stat=Sent (jAP8Ihhv003776 Message accepted for delivery)
cornette-lt sendmail[3777] jAP8Ihhv003776: to=<root@localhost.localdomain>,
ctladdr=<root@localhost.localdomain> (0/0), delay=00:00:00, xdelay=00:00:00,
mailer=local, pri=31649, dsn=2.0.0, stat=Sent
cornette-lt sendmail[22965] jAP927Pv022965: from=root, size=1116, class=0,
nrcpts=1, msgid=<200511250902.jAP927Pv022965@localhost.localdomain>,
relay=root@localhost
cornette-lt sendmail[22968] jAP927rH022968: from=<root@localhost.localdomain>,
size=1422, class=0, nrcpts=1,
msgid=<200511250902.jAP927Pv022965@localhost.localdomain>, proto=ESMTP,
daemon=MTA, relay=cornette-lt [127.0.0.1]
cornette-lt sendmail[22965] jAP927Pv022965: to=root, ctladdr=root (0/0),
delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=31116, relay=[127.0.0.1]
[127.0.0.1], dsn=2.0.0, stat=Sent (jAP927rH022968 Message accepted for delivery)
cornette-lt sendmail[22970] jAP927rH022968: to=<root@localhost.localdomain>,
ctladdr=<root@localhost.localdomain> (0/0), delay=00:00:01, xdelay=00:00:00,
mailer=local, pri=31649, dsn=2.0.0, stat=Sent
cornette-lt sendmail[15080] jAP9LYDw015080: from=root, size=270, class=0,
nrcpts=1, msgid=<200511250921.jAP9LYDw015080@localhost.localdomain>,
relay=root@localhost
cornette-lt sendmail[15117] jAP9LZNq015117: from=<root@localhost.localdomain>,
size=558, class=0, nrcpts=1,
msgid=<200511250921.jAP9LYDw015080@localhost.localdomain>, proto=ESMTP,
daemon=MTA, relay=cornette-lt [127.0.0.1]
cornette-lt sendmail[15080] jAP9LYDw015080: to=root, ctladdr=root (0/0),
delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=30270, relay=[127.0.0.1]
[127.0.0.1], dsn=2.0.0, stat=Sent (jAP9LZNq015117 Message accepted for delivery)
cornette-lt sendmail[15124] jAP9LZNq015117: to=<root@localhost.localdomain>,
ctladdr=<root@localhost.localdomain> (0/0), delay=00:00:00, xdelay=00:00:00,
mailer=local, pri=30784, dsn=2.0.0, stat=Sent
cornette-lt sendmail[18730] alias database /etc/aliases rebuilt by jim
cornette-lt sendmail[18730] /etc/aliases: 77 aliases, longest 10 bytes, 772
bytes total
Comment 4 Jim Cornette 2005-11-25 21:56:44 EST
Changing version to FC5 test1 since with a clean install from discs, the problem
is the same.
Comment 5 Daniel Walsh 2005-11-30 09:49:02 EST
restorecon /etc/alias* fixes this problem

We are looking into why this is happening.
Comment 6 Jim Cornette 2005-11-30 21:03:53 EST
Thanks!
I have seen this happen on three different systems tested. I'll try the fix.
Comment 7 Jim Cornette 2005-12-16 22:56:50 EST
This bug does not seem to be a problem for me now. If you did your
investigation, this bug can be closed.

Note You need to log in before you can comment on or make changes to this bug.