Created attachment 1949150 [details] syslog (arpwatch + audit + setroubleshoot) Description of problem: arpwatch would send an email on event, calling /usr/sbin/sendmail. msmtp is small MTA, like esmtp, that can be used to provide an alternative to /usr/sbin/sendmail. Unfortunately, arpwatch.service is not allowed to use msmtp Version-Release number of selected component (if applicable): arpwatch-3.3-14.fc39.x86_64 msmtp-1.8.23-1.fc38.x86_64 selinux-policy-38.8-1.fc39.noarch Steps to Reproduce: In a virtual machine 1. dnf install arpwatch # esmtp is likely going to be installed as dependency 2. dnf install msmtp # msmtp should now provide mta 3. systemctl start arpwatch 4. journalctl --unit arpwatch --follow Actual results: arpwatch[1006]: execl: /usr/sbin/sendmail: Permission denied Expected results: arpwatch should have been allowed to use the MTA.
Caught in permissive mode: ---- type=PROCTITLE msg=audit(03/09/2023 09:10:38.507:471) : proctitle=/usr/sbin/arpwatch -u arpwatch -F -C type=PATH msg=audit(03/09/2023 09:10:38.507:471) : item=0 name=/usr/sbin/sendmail inode=1093403 dev=00:1e mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(03/09/2023 09:10:38.507:471) : cwd=/var/lib/arpwatch type=SYSCALL msg=audit(03/09/2023 09:10:38.507:471) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0x557e3d11130a a1=0x7ffff08c8240 a2=0x7ffff08c92e8 a3=0x557e3d111314 items=1 ppid=4373 pid=4446 auid=unset uid=arpwatch gid=arpwatch euid=arpwatch suid=arpwatch fsuid=arpwatch egid=arpwatch sgid=arpwatch fsgid=arpwatch tty=(none) ses=unset comm=arpwatch exe=/usr/sbin/arpwatch subj=system_u:system_r:arpwatch_t:s0 key=(null) type=AVC msg=audit(03/09/2023 09:10:38.507:471) : avc: denied { execute } for pid=4446 comm=arpwatch name=msmtp dev="vda2" ino=1093403 scontext=system_u:system_r:arpwatch_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=0 ---- The problem exists for some time already because I can reproduce it on Fedora 36 VM as well: # rpm -qa selinux\* arpwatch\* msmtp\* | sort arpwatch-3.3-8.fc36.x86_64 msmtp-1.8.23-1.fc36.x86_64 selinux-policy-36.16-1.fc36.noarch selinux-policy-devel-36.16-1.fc36.noarch selinux-policy-doc-36.16-1.fc36.noarch selinux-policy-sandbox-36.16-1.fc36.noarch selinux-policy-targeted-36.16-1.fc36.noarch # rpm -qf /usr/sbin/sendmail esmtp-1.2-19.fc36.x86_64 # ls -l /usr/sbin/sendmail lrwxrwxrwx. 1 root root 21 Mar 9 09:08 /usr/sbin/sendmail -> /etc/alternatives/mta # ls -l /etc/alternatives/mta lrwxrwxrwx. 1 root root 14 Mar 9 09:08 /etc/alternatives/mta -> /usr/bin/msmtp #
The following SELinux denials appeared after making the arpwatch_t policy permissive: ---- type=PROCTITLE msg=audit(03/09/2023 03:48:54.293:469) : proctitle=sendmail -odi root type=PATH msg=audit(03/09/2023 03:48:54.293:469) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=139847 dev=fc:02 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(03/09/2023 03:48:54.293:469) : item=0 name=/usr/sbin/sendmail inode=202158 dev=fc:02 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(03/09/2023 03:48:54.293:469) : cwd=/var/lib/arpwatch type=EXECVE msg=audit(03/09/2023 03:48:54.293:469) : argc=3 a0=sendmail a1=-odi a2=root type=SYSCALL msg=audit(03/09/2023 03:48:54.293:469) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x5644e70bd30a a1=0x7fffd06ecb60 a2=0x7fffd06edc58 a3=0x5644e70bd314 items=2 ppid=1395 pid=1409 auid=unset uid=arpwatch gid=arpwatch euid=arpwatch suid=arpwatch fsuid=arpwatch egid=arpwatch sgid=arpwatch fsgid=arpwatch tty=(none) ses=unset comm=sendmail exe=/usr/bin/msmtp subj=system_u:system_r:arpwatch_t:s0 key=(null) type=AVC msg=audit(03/09/2023 03:48:54.293:469) : avc: denied { map } for pid=1409 comm=sendmail path=/usr/bin/msmtp dev="vda2" ino=202158 scontext=system_u:system_r:arpwatch_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1 type=AVC msg=audit(03/09/2023 03:48:54.293:469) : avc: denied { execute_no_trans } for pid=1409 comm=arpwatch path=/usr/bin/msmtp dev="vda2" ino=202158 scontext=system_u:system_r:arpwatch_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1 type=AVC msg=audit(03/09/2023 03:48:54.293:469) : avc: denied { execute } for pid=1409 comm=arpwatch name=msmtp dev="vda2" ino=202158 scontext=system_u:system_r:arpwatch_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1 ---- # rpm -qa selinux\* arpwatch\* \*smtp\* | sort arpwatch-3.3-14.fc39.x86_64 esmtp-1.2-21.fc38.x86_64 libesmtp-1.0.6-27.fc38.x86_64 msmtp-1.8.23-1.fc38.x86_64 selinux-policy-38.8-1.fc39.noarch selinux-policy-targeted-38.8-1.fc39.noarch #
I've submitted a Fedora PR to address the issue: https://github.com/fedora-selinux/selinux-policy/pull/1623 Can you try the scratchbuild to see if there are any other denials on your system? Checks -> Artifacts -> rpms.zip
Observation: the SELinux denial shown in comment#1 appears every 1 minute after restarting the arpwatch service.
Test coverage for this BZ exists in a form of MR: * https://gitlab.com/redhat/rhel/tests/selinux-policy/-/merge_requests/87 The MR waits for review.
I can confirm that SELinux denials do not appear after upgrading to: # rpm -qa selinux\* selinux-policy-38.8-1.20230309_084534.d4cfe55.fc38.noarch selinux-policy-targeted-38.8-1.20230309_084534.d4cfe55.fc38.noarch # And new "permission denied" messages do not appear in the systemd journal anymore.
(In reply to Zdenek Pytela from comment #3) > I've submitted a Fedora PR to address the issue: > https://github.com/fedora-selinux/selinux-policy/pull/1623 > > Can you try the scratchbuild to see if there are any other denials on your > system? > Checks -> Artifacts -> rpms.zip Tested. Like @mmalik , I confirm it addresses the issue: arpwatch is allowed to send email through msmtp's /usr/sbin/sendmail. Thanks !
Thank you both for the feedback, merging.