Bug 1881884
| Summary: | SELinux policy denies dovecot's bind to TCP submission ports 465/587 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Graham Leggett <minfrin> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | high | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.4 | CC: | lvrabec, mmalik, plautrba, ssekidde |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 8.4 | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | No Doc Update | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-05-18 14:57:54 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Quick ping on this one - we have to temporarily disabled selinux to work around this, any news on when we can turn it back on? Thank you for taking the time to report this issue to us. We appreciate the feedback and use reports such as this one to guide our efforts at improving our products. That being said, this bug tracking system is not a mechanism for requesting support, and we are not able to guarantee the timeliness or suitability of a resolution. If this issue is critical or in any way time sensitive, please raise a ticket through the regular Red Hat support channels to ensure it receives the proper attention and prioritization to assure a timely resolution. This bz will be evaluated for inclusion into the next minor product update. These workarounds are available: - set the domain to permissive: # semanage permissive -a dovecot_t - create a local SELinux policy module # rpm -qa selinux\* dovecot\* | sort
dovecot-2.3.8-4.el8.x86_64
selinux-policy-3.14.3-54.el8.noarch
selinux-policy-devel-3.14.3-54.el8.noarch
selinux-policy-doc-3.14.3-54.el8.noarch
selinux-policy-minimum-3.14.3-54.el8.noarch
selinux-policy-mls-3.14.3-54.el8.noarch
selinux-policy-sandbox-3.14.3-54.el8.noarch
selinux-policy-targeted-3.14.3-54.el8.noarch
# grep ^protocols /etc/dovecot/dovecot.conf
protocols = imap pop3 lmtp submission
#
Following SELinux denial appeared after starting the dovecot service:
----
type=PROCTITLE msg=audit(10/02/2020 09:13:43.841:982) : proctitle=/usr/sbin/dovecot -F
type=SOCKADDR msg=audit(10/02/2020 09:13:43.841:982) : saddr={ saddr_fam=inet laddr=0.0.0.0 lport=587 }
type=SYSCALL msg=audit(10/02/2020 09:13:43.841:982) : arch=x86_64 syscall=bind success=no exit=EACCES(Permission denied) a0=0x12 a1=0x7fff4c21d9c0 a2=0x10 a3=0x7fff4c21d9b8 items=0 ppid=1 pid=67058 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=dovecot exe=/usr/sbin/dovecot subj=system_u:system_r:dovecot_t:s0 key=(null)
type=AVC msg=audit(10/02/2020 09:13:43.841:982) : avc: denied { name_bind } for pid=67058 comm=dovecot src=587 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:smtp_port_t:s0 tclass=tcp_socket permissive=0
----
The only SELinux denial which appeared in permissive mode is:
----
type=PROCTITLE msg=audit(10/02/2020 09:17:33.968:1003) : proctitle=/usr/sbin/dovecot -F
type=SOCKADDR msg=audit(10/02/2020 09:17:33.968:1003) : saddr={ saddr_fam=inet laddr=0.0.0.0 lport=587 }
type=SYSCALL msg=audit(10/02/2020 09:17:33.968:1003) : arch=x86_64 syscall=bind success=yes exit=0 a0=0x13 a1=0x7ffc0a6b99a0 a2=0x10 a3=0x7ffc0a6b9998 items=0 ppid=1 pid=68509 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=dovecot exe=/usr/sbin/dovecot subj=system_u:system_r:dovecot_t:s0 key=(null)
type=AVC msg=audit(10/02/2020 09:17:33.968:1003) : avc: denied { name_bind } for pid=68509 comm=dovecot src=587 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:smtp_port_t:s0 tclass=tcp_socket permissive=1
----
Neither the submission port (port 587) nor the submissions port (port 465, SSL) work when dovecot is asked to be the submissions server. If you don't configure dovecot to listen on the secure submission port (465), dovecot won't try to bind. From SELinux policy point-of-view, both ports have the same SELinux label:
# seinfo --portcon 465 | grep tcp
portcon tcp 1-511 system_u:object_r:reserved_port_t:s0
portcon tcp 465 system_u:object_r:smtp_port_t:s0
# seinfo --portcon 587 | grep tcp
portcon tcp 512-1023 system_u:object_r:hi_reserved_port_t:s0
portcon tcp 587 system_u:object_r:smtp_port_t:s0
#
Which means that binding to both ports can be allowed using 1 rule:
allow dovecot_t smtp_port_t : tcp_socket { name_bind };
# grep -A 7 submission-login /etc/dovecot/conf.d/10-master.conf
service submission-login {
inet_listener submission {
port = 587
}
inet_listener submission_legacy {
port = 465
}
}
#
Here they are:
----
type=PROCTITLE msg=audit(10/02/2020 07:57:20.739:318) : proctitle=/usr/sbin/dovecot -F
type=SYSCALL msg=audit(10/02/2020 07:57:20.739:318) : arch=x86_64 syscall=bind success=no exit=EACCES(Permission denied) a0=0x12 a1=0x7ffc78bfcf40 a2=0x10 a3=0x7ffc78bfcf38 items=0 ppid=1 pid=6671 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=dovecot exe=/usr/sbin/dovecot subj=system_u:system_r:dovecot_t:s0 key=(null)
type=AVC msg=audit(10/02/2020 07:57:20.739:318) : avc: denied { name_bind } for pid=6671 comm=dovecot src=587 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:smtp_port_t:s0 tclass=tcp_socket permissive=0
----
type=PROCTITLE msg=audit(10/02/2020 07:57:20.740:319) : proctitle=/usr/sbin/dovecot -F
type=SYSCALL msg=audit(10/02/2020 07:57:20.740:319) : arch=x86_64 syscall=bind success=no exit=EACCES(Permission denied) a0=0x12 a1=0x7ffc78bfcf40 a2=0x1c a3=0x7ffc78bfcf38 items=0 ppid=1 pid=6671 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=dovecot exe=/usr/sbin/dovecot subj=system_u:system_r:dovecot_t:s0 key=(null)
type=AVC msg=audit(10/02/2020 07:57:20.740:319) : avc: denied { name_bind } for pid=6671 comm=dovecot src=587 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:smtp_port_t:s0 tclass=tcp_socket permissive=0
----
type=PROCTITLE msg=audit(10/02/2020 07:57:20.740:320) : proctitle=/usr/sbin/dovecot -F
type=SYSCALL msg=audit(10/02/2020 07:57:20.740:320) : arch=x86_64 syscall=bind success=no exit=EACCES(Permission denied) a0=0x12 a1=0x7ffc78bfcf40 a2=0x10 a3=0x7ffc78bfcf38 items=0 ppid=1 pid=6671 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=dovecot exe=/usr/sbin/dovecot subj=system_u:system_r:dovecot_t:s0 key=(null)
type=AVC msg=audit(10/02/2020 07:57:20.740:320) : avc: denied { name_bind } for pid=6671 comm=dovecot src=465 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:smtp_port_t:s0 tclass=tcp_socket permissive=0
----
type=PROCTITLE msg=audit(10/02/2020 07:57:20.740:321) : proctitle=/usr/sbin/dovecot -F
type=SYSCALL msg=audit(10/02/2020 07:57:20.740:321) : arch=x86_64 syscall=bind success=no exit=EACCES(Permission denied) a0=0x12 a1=0x7ffc78bfcf40 a2=0x1c a3=0x7ffc78bfcf38 items=0 ppid=1 pid=6671 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=dovecot exe=/usr/sbin/dovecot subj=system_u:system_r:dovecot_t:s0 key=(null)
type=AVC msg=audit(10/02/2020 07:57:20.740:321) : avc: denied { name_bind } for pid=6671 comm=dovecot src=465 scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:smtp_port_t:s0 tclass=tcp_socket permissive=0
----
I've submitted a Fedora PR to address the issue: https://github.com/fedora-selinux/selinux-policy-contrib/pull/362 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:1639 |
Description of problem: If dovecot is configured to enable the "submission" service with "protocols = $protocols submission" and ports 465 and 587, SELinux refuses to allow dovecot to start. Version-Release number of selected component (if applicable): How reproducible: Always. Steps to Reproduce: 1. Configure dovecot to enable the submission service: protocols = $protocols submission 2. Optional: add the legacy 465 port as follows: service submission-login { inet_listener submission { port = 587 } inet_listener submission_legacy { port = 465 } } 3. Actual results: Dovecot refuses to start: Sep 23 11:57:13 gatekeeper dovecot[44137]: master: Error: bind(0.0.0.0, 587) failed: Permission denied Sep 23 11:57:13 gatekeeper dovecot[44137]: master: Error: service(submission-login): listen(*, 587) failed: Permission denied Sep 23 11:57:13 gatekeeper dovecot[44137]: master: Error: bind(::, 587) failed: Permission denied Sep 23 11:57:13 gatekeeper dovecot[44137]: master: Error: service(submission-login): listen(::, 587) failed: Permission denied Sep 23 11:57:13 gatekeeper dovecot[44137]: master: Error: bind(0.0.0.0, 465) failed: Permission denied Sep 23 11:57:13 gatekeeper dovecot[44137]: master: Error: service(submission-login): listen(*, 465) failed: Permission denied Sep 23 11:57:13 gatekeeper dovecot[44137]: master: Error: bind(::, 465) failed: Permission denied Sep 23 11:57:13 gatekeeper dovecot[44137]: master: Error: service(submission-login): listen(::, 465) failed: Permission denied Sep 23 11:57:13 gatekeeper dovecot[44137]: master: Fatal: Failed to start listeners Expected results: Dovecot starts as expected. Additional info: