Bug 189555 - Selinux appears to prevent postfix / cyrus-imapd intergration
Selinux appears to prevent postfix / cyrus-imapd intergration
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
5
All Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-04-20 21:33 EDT by Evan Clarke
Modified: 2007-11-30 17:11 EST (History)
1 user (show)

See Also:
Fixed In Version: Current
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-03-28 16:03:07 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Evan Clarke 2006-04-20 21:33:54 EDT
Description of problem:
While attempting to get postfix to act as the MTA for cyrus-imapd through the 
/var/lib/imap/socket/lmtp socket, I get an audit error:

Apr 21 11:37:43 localhost kernel: audit(1145583463.886:8): avc:  denied  {
search } for  pid=4476 comm="lmtp" name="lib" dev=dm-0 ino=3145730
scontext=user_u:system_r:postfix_master_t:s0
tcontext=system_u:object_r:var_lib_t:s0 tclass=dir

Version-Release number of selected component (if applicable):
selinux-policy-2.2.29-3.fc5
libselinux-1.30-1.fc5
selinux-policy-targeted-2.2.29-3.fc5
postfix-2.2.8-1.2
cyrus-imapd-2.3.1-2.6.fc5

How reproducible:
1

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:
Comment 1 Daniel Walsh 2006-04-24 20:12:44 EDT
Can you run this with setenforce 0 and send me the avc log file.

Dan
Comment 2 Evan Clarke 2006-04-26 03:47:19 EDT
I disabled enforce mode in the GNOME security-level switcher when I had these
problems.  Everything works OK with selinux in permissive mode.

Here is a snippet of the log file from boot to sending and receiving a test
message (locally).  I noticed another couple of AVC messages (lvm.static and
bluez-pin) that I have left in the log.  Do you want new bugs opened for those?

[evan@localhost log]$ sudo grep avc /var/log/messages
Password: 
Apr 26 04:39:46 localhost kernel: audit(1145990386.612:6): avc:  denied  { Apr
26 17:40:03 localhost kernel: audit(1146037188.790:2): avc:  denied  { ioctl }
for  pid=1231 comm="lvm.static" name="hdd" dev=tmpfs ino=2949
scontext=system_u:system_r:lvm_t:s0
tcontext=system_u:object_r:removable_device_t:s0 tclass=blk_file
Apr 26 17:40:14 localhost kernel: audit(1146037214.031:3): avc:  denied  {
getattr } for  pid=1954 comm="sh" name="mailq.postfix.1.gz" dev=dm-0
ino=27239387 scontext=system_u:system_r:postfix_master_t:s0
tcontext=system_u:object_r:man_t:s0 tclass=file
Apr 26 17:41:31 localhost kernel: audit(1146037291.288:4): avc:  denied  { use }
for  pid=2410 comm="bluez-pin" name="[7837]" dev=pipefs ino=7837
scontext=user_u:system_r:bluetooth_helper_t:s0
tcontext=system_u:system_r:xdm_t:s0-s0:c0.c255 tclass=fd
Apr 26 17:41:31 localhost kernel: audit(1146037291.288:5): avc:  denied  { write
} for  pid=2410 comm="bluez-pin" name="[7837]" dev=pipefs ino=7837
scontext=user_u:system_r:bluetooth_helper_t:s0
tcontext=system_u:system_r:xdm_t:s0-s0:c0.c255 tclass=fifo_file
Apr 26 17:46:04 localhost kernel: audit(1146037564.793:6): avc:  denied  {
search } for  pid=2787 comm="lmtp" name="lib" dev=dm-0 ino=3145730
scontext=system_u:system_r:postfix_master_t:s0
tcontext=system_u:object_r:var_lib_t:s0 tclass=dir
Apr 26 17:46:04 localhost kernel: audit(1146037564.793:7): avc:  denied  {
search } for  pid=2787 comm="lmtp" name="imap" dev=dm-0 ino=3147037
scontext=system_u:system_r:postfix_master_t:s0
tcontext=system_u:object_r:cyrus_var_lib_t:s0 tclass=dir
Apr 26 17:46:04 localhost kernel: audit(1146037564.793:8): avc:  denied  { write
} for  pid=2787 comm="lmtp" name="lmtp" dev=dm-0 ino=3147061
scontext=system_u:system_r:postfix_master_t:s0
tcontext=system_u:object_r:cyrus_var_lib_t:s0 tclass=sock_file
Apr 26 17:46:04 localhost kernel: audit(1146037564.793:9): avc:  denied  {
connectto } for  pid=2787 comm="lmtp" name="lmtp"
scontext=system_u:system_r:postfix_master_t:s0
tcontext=system_u:system_r:cyrus_t:s0 tclass=unix_stream_socket
[evan@localhost ~]$
Comment 4 Daniel Walsh 2006-05-09 11:40:46 EDT
fixed in selinux-policy-2.2.38-1.FC5.
Comment 5 Daniel Walsh 2007-03-28 16:03:07 EDT
Closing bugs

Note You need to log in before you can comment on or make changes to this bug.