Description of problem: While attempting to get postfix to act as the MTA for cyrus-imapd through the /var/lib/imap/socket/lmtp socket, I get an audit error: Apr 21 11:37:43 localhost kernel: audit(1145583463.886:8): avc: denied { search } for pid=4476 comm="lmtp" name="lib" dev=dm-0 ino=3145730 scontext=user_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir Version-Release number of selected component (if applicable): selinux-policy-2.2.29-3.fc5 libselinux-1.30-1.fc5 selinux-policy-targeted-2.2.29-3.fc5 postfix-2.2.8-1.2 cyrus-imapd-2.3.1-2.6.fc5 How reproducible: 1 Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
Can you run this with setenforce 0 and send me the avc log file. Dan
I disabled enforce mode in the GNOME security-level switcher when I had these problems. Everything works OK with selinux in permissive mode. Here is a snippet of the log file from boot to sending and receiving a test message (locally). I noticed another couple of AVC messages (lvm.static and bluez-pin) that I have left in the log. Do you want new bugs opened for those? [evan@localhost log]$ sudo grep avc /var/log/messages Password: Apr 26 04:39:46 localhost kernel: audit(1145990386.612:6): avc: denied { Apr 26 17:40:03 localhost kernel: audit(1146037188.790:2): avc: denied { ioctl } for pid=1231 comm="lvm.static" name="hdd" dev=tmpfs ino=2949 scontext=system_u:system_r:lvm_t:s0 tcontext=system_u:object_r:removable_device_t:s0 tclass=blk_file Apr 26 17:40:14 localhost kernel: audit(1146037214.031:3): avc: denied { getattr } for pid=1954 comm="sh" name="mailq.postfix.1.gz" dev=dm-0 ino=27239387 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:man_t:s0 tclass=file Apr 26 17:41:31 localhost kernel: audit(1146037291.288:4): avc: denied { use } for pid=2410 comm="bluez-pin" name="[7837]" dev=pipefs ino=7837 scontext=user_u:system_r:bluetooth_helper_t:s0 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c255 tclass=fd Apr 26 17:41:31 localhost kernel: audit(1146037291.288:5): avc: denied { write } for pid=2410 comm="bluez-pin" name="[7837]" dev=pipefs ino=7837 scontext=user_u:system_r:bluetooth_helper_t:s0 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c255 tclass=fifo_file Apr 26 17:46:04 localhost kernel: audit(1146037564.793:6): avc: denied { search } for pid=2787 comm="lmtp" name="lib" dev=dm-0 ino=3145730 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir Apr 26 17:46:04 localhost kernel: audit(1146037564.793:7): avc: denied { search } for pid=2787 comm="lmtp" name="imap" dev=dm-0 ino=3147037 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:cyrus_var_lib_t:s0 tclass=dir Apr 26 17:46:04 localhost kernel: audit(1146037564.793:8): avc: denied { write } for pid=2787 comm="lmtp" name="lmtp" dev=dm-0 ino=3147061 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:cyrus_var_lib_t:s0 tclass=sock_file Apr 26 17:46:04 localhost kernel: audit(1146037564.793:9): avc: denied { connectto } for pid=2787 comm="lmtp" name="lmtp" scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:system_r:cyrus_t:s0 tclass=unix_stream_socket [evan@localhost ~]$
fixed in selinux-policy-2.2.38-1.FC5.
Closing bugs