Bug 2176583 - arpwatch is not allowed to use msmtp as /usr/sbin/sendmail
Summary: arpwatch is not allowed to use msmtp as /usr/sbin/sendmail
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: All
OS: Linux
medium
unspecified
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-03-08 20:36 UTC by Yann Droneaud
Modified: 2023-04-04 18:32 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
: 2213573 (view as bug list)
Environment:
Last Closed: 2023-04-04 18:32:23 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
syslog (arpwatch + audit + setroubleshoot) (7.62 KB, text/plain)
2023-03-08 20:36 UTC, Yann Droneaud
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 1623 0 None open Msmtp 2023-03-09 09:09:21 UTC

Description Yann Droneaud 2023-03-08 20:36:24 UTC
Created attachment 1949150 [details]
syslog (arpwatch + audit + setroubleshoot)

Description of problem:

  arpwatch would send an email on event, calling /usr/sbin/sendmail.

  msmtp is small MTA, like esmtp, that can be used to provide an alternative to /usr/sbin/sendmail.

  Unfortunately, arpwatch.service is not allowed to use msmtp

Version-Release number of selected component (if applicable):

  arpwatch-3.3-14.fc39.x86_64
  msmtp-1.8.23-1.fc38.x86_64
  selinux-policy-38.8-1.fc39.noarch

Steps to Reproduce:

  In a virtual machine

  1. dnf install arpwatch  # esmtp is likely going to be installed as dependency
  2. dnf install msmtp     # msmtp should now provide mta
  3. systemctl start arpwatch
  4. journalctl --unit arpwatch --follow

Actual results:

  arpwatch[1006]: execl: /usr/sbin/sendmail: Permission denied

Expected results:

  arpwatch should have been allowed to use the MTA.

Comment 1 Milos Malik 2023-03-09 08:15:29 UTC
Caught in permissive mode:
----
type=PROCTITLE msg=audit(03/09/2023 09:10:38.507:471) : proctitle=/usr/sbin/arpwatch -u arpwatch -F -C 
type=PATH msg=audit(03/09/2023 09:10:38.507:471) : item=0 name=/usr/sbin/sendmail inode=1093403 dev=00:1e mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(03/09/2023 09:10:38.507:471) : cwd=/var/lib/arpwatch 
type=SYSCALL msg=audit(03/09/2023 09:10:38.507:471) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0x557e3d11130a a1=0x7ffff08c8240 a2=0x7ffff08c92e8 a3=0x557e3d111314 items=1 ppid=4373 pid=4446 auid=unset uid=arpwatch gid=arpwatch euid=arpwatch suid=arpwatch fsuid=arpwatch egid=arpwatch sgid=arpwatch fsgid=arpwatch tty=(none) ses=unset comm=arpwatch exe=/usr/sbin/arpwatch subj=system_u:system_r:arpwatch_t:s0 key=(null) 
type=AVC msg=audit(03/09/2023 09:10:38.507:471) : avc:  denied  { execute } for  pid=4446 comm=arpwatch name=msmtp dev="vda2" ino=1093403 scontext=system_u:system_r:arpwatch_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=0 
----

The problem exists for some time already because I can reproduce it on Fedora 36 VM as well:

# rpm -qa selinux\* arpwatch\* msmtp\* | sort
arpwatch-3.3-8.fc36.x86_64
msmtp-1.8.23-1.fc36.x86_64
selinux-policy-36.16-1.fc36.noarch
selinux-policy-devel-36.16-1.fc36.noarch
selinux-policy-doc-36.16-1.fc36.noarch
selinux-policy-sandbox-36.16-1.fc36.noarch
selinux-policy-targeted-36.16-1.fc36.noarch
# rpm -qf /usr/sbin/sendmail 
esmtp-1.2-19.fc36.x86_64
# ls -l /usr/sbin/sendmail 
lrwxrwxrwx. 1 root root 21 Mar  9 09:08 /usr/sbin/sendmail -> /etc/alternatives/mta
# ls -l /etc/alternatives/mta
lrwxrwxrwx. 1 root root 14 Mar  9 09:08 /etc/alternatives/mta -> /usr/bin/msmtp
#

Comment 2 Milos Malik 2023-03-09 08:52:08 UTC
The following SELinux denials appeared after making the arpwatch_t policy permissive:
----
type=PROCTITLE msg=audit(03/09/2023 03:48:54.293:469) : proctitle=sendmail -odi root 
type=PATH msg=audit(03/09/2023 03:48:54.293:469) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=139847 dev=fc:02 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(03/09/2023 03:48:54.293:469) : item=0 name=/usr/sbin/sendmail inode=202158 dev=fc:02 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(03/09/2023 03:48:54.293:469) : cwd=/var/lib/arpwatch 
type=EXECVE msg=audit(03/09/2023 03:48:54.293:469) : argc=3 a0=sendmail a1=-odi a2=root 
type=SYSCALL msg=audit(03/09/2023 03:48:54.293:469) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x5644e70bd30a a1=0x7fffd06ecb60 a2=0x7fffd06edc58 a3=0x5644e70bd314 items=2 ppid=1395 pid=1409 auid=unset uid=arpwatch gid=arpwatch euid=arpwatch suid=arpwatch fsuid=arpwatch egid=arpwatch sgid=arpwatch fsgid=arpwatch tty=(none) ses=unset comm=sendmail exe=/usr/bin/msmtp subj=system_u:system_r:arpwatch_t:s0 key=(null) 
type=AVC msg=audit(03/09/2023 03:48:54.293:469) : avc:  denied  { map } for  pid=1409 comm=sendmail path=/usr/bin/msmtp dev="vda2" ino=202158 scontext=system_u:system_r:arpwatch_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1 
type=AVC msg=audit(03/09/2023 03:48:54.293:469) : avc:  denied  { execute_no_trans } for  pid=1409 comm=arpwatch path=/usr/bin/msmtp dev="vda2" ino=202158 scontext=system_u:system_r:arpwatch_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1 
type=AVC msg=audit(03/09/2023 03:48:54.293:469) : avc:  denied  { execute } for  pid=1409 comm=arpwatch name=msmtp dev="vda2" ino=202158 scontext=system_u:system_r:arpwatch_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1 
----

# rpm -qa selinux\* arpwatch\* \*smtp\* | sort
arpwatch-3.3-14.fc39.x86_64
esmtp-1.2-21.fc38.x86_64
libesmtp-1.0.6-27.fc38.x86_64
msmtp-1.8.23-1.fc38.x86_64
selinux-policy-38.8-1.fc39.noarch
selinux-policy-targeted-38.8-1.fc39.noarch
#

Comment 3 Zdenek Pytela 2023-03-09 09:09:21 UTC
I've submitted a Fedora PR to address the issue:
https://github.com/fedora-selinux/selinux-policy/pull/1623

Can you try the scratchbuild to see if there are any other denials on your system?
Checks -> Artifacts -> rpms.zip

Comment 4 Milos Malik 2023-03-09 09:16:23 UTC
Observation: the SELinux denial shown in comment#1 appears every 1 minute after restarting the arpwatch service.

Comment 5 Milos Malik 2023-03-09 09:46:06 UTC
Test coverage for this BZ exists in a form of MR:
 * https://gitlab.com/redhat/rhel/tests/selinux-policy/-/merge_requests/87

The MR waits for review.

Comment 6 Milos Malik 2023-03-09 10:27:01 UTC
I can confirm that SELinux denials do not appear after upgrading to:

# rpm -qa selinux\*
selinux-policy-38.8-1.20230309_084534.d4cfe55.fc38.noarch
selinux-policy-targeted-38.8-1.20230309_084534.d4cfe55.fc38.noarch
#

And new "permission denied" messages do not appear in the systemd journal anymore.

Comment 8 Yann Droneaud 2023-03-09 19:22:39 UTC
(In reply to Zdenek Pytela from comment #3)
> I've submitted a Fedora PR to address the issue:
> https://github.com/fedora-selinux/selinux-policy/pull/1623
> 
> Can you try the scratchbuild to see if there are any other denials on your
> system?
> Checks -> Artifacts -> rpms.zip

Tested. Like @mmalik , I confirm it addresses the issue: arpwatch is allowed to send email through msmtp's /usr/sbin/sendmail.

Thanks !

Comment 9 Zdenek Pytela 2023-03-10 07:54:25 UTC
Thank you both for the feedback, merging.


Note You need to log in before you can comment on or make changes to this bug.