Description of problem: This issue randomly appears on a new installation of Fedora. I'm a bit concerned about why the sendmail daemon is even running, as I haven't configured it for any purpose. SELinux is preventing sendmail from using the 'sys_admin' capabilities. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that sendmail should have the sys_admin capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'sendmail' --raw | audit2allow -M my-sendmail # semodule -X 300 -i my-sendmail.pp Additional Information: Source Context system_u:system_r:system_mail_t:s0-s0:c0.c1023 Target Context system_u:system_r:system_mail_t:s0-s0:c0.c1023 Target Objects Unknown [ capability ] Source sendmail Source Path sendmail Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-38.20-1.fc38.noarch Local Policy RPM selinux-policy-targeted-38.20-1.fc38.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 6.3.12-200.fc38.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jul 6 04:05:18 UTC 2023 x86_64 Alert Count 62 First Seen 2023-07-17 03:37:56 BST Last Seen 2023-07-24 03:56:25 BST Local ID cd4a36fa-3339-40f4-ac1f-5e87916c5aff Raw Audit Messages type=AVC msg=audit(1690167385.940:3011): avc: denied { sys_admin } for pid=1136319 comm="sendmail" capability=21 scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 Hash: sendmail,system_mail_t,system_mail_t,capability,sys_admin ----------------------------- I haven't configured sendmail to do anything on my system, so I'm not sure why it's triggering an SELinux violation. Version-Release number of selected component: selinux-policy-targeted-38.20-1.fc38.noarch Additional info: reporter: libreport-2.17.11 component: selinux-policy reason: SELinux is preventing sendmail from using the 'sys_admin' capabilities. type: libreport package: selinux-policy-targeted-38.20-1.fc38.noarch kernel: 6.3.12-200.fc38.x86_64 hashmarkername: setroubleshoot component: selinux-policy
Created attachment 1977180 [details] File: description
Created attachment 1977181 [details] File: os_info
Hi, Do you know which configuration change is required to trigger this capability request? Can you reproduce the issue with full auditing enabled? https://fedoraproject.org/wiki/SELinux/Debugging#Enable_full_auditing
Hi, I will give the full auditing a go as soon as I can, however I'm not sure of the frequency (it seems weekly) of the problem, so it may take a while to report back - in the interim, I did some basic digging just after it happened last time - I'm not sure if it's actually a problem with SELinux or perhaps it is configured correctly, and a problem with another package: I believe the sendmail utility is provided by the esmtp package, so I did dnf repoquery -q --installed --whatrequires esmtp, the only dependent package is "BackupPC-0:4.4.0-9.fc38.x86_64" which isn't configured on my system. I did a basic audit search: ------------------------------------------------------------------- [user@fedora ~]$ sudo ausearch -i -c 'sendmail' ---- type=AVC msg=audit(17/07/23 03:37:56.413:2394) : avc: denied { sys_resource } for pid=710552 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:37:56.413:2395) : avc: denied { sys_admin } for pid=710552 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:37:56.414:2396) : avc: denied { sys_resource } for pid=710552 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:37:56.414:2397) : avc: denied { sys_admin } for pid=710552 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:37:56.416:2398) : avc: denied { sys_resource } for pid=710552 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:37:56.416:2399) : avc: denied { sys_admin } for pid=710552 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.425:2402) : avc: denied { sys_resource } for pid=710562 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.425:2403) : avc: denied { sys_admin } for pid=710562 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.426:2404) : avc: denied { sys_resource } for pid=710562 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.426:2405) : avc: denied { sys_admin } for pid=710562 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.428:2406) : avc: denied { sys_resource } for pid=710562 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.428:2407) : avc: denied { sys_admin } for pid=710562 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.429:2408) : avc: denied { sys_resource } for pid=710562 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.429:2409) : avc: denied { sys_admin } for pid=710562 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.431:2410) : avc: denied { sys_resource } for pid=710562 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.431:2411) : avc: denied { sys_admin } for pid=710562 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.432:2412) : avc: denied { sys_resource } for pid=710562 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.432:2413) : avc: denied { sys_admin } for pid=710562 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.434:2414) : avc: denied { sys_resource } for pid=710562 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.434:2415) : avc: denied { sys_admin } for pid=710562 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.443:2416) : avc: denied { sys_resource } for pid=710612 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.443:2417) : avc: denied { sys_admin } for pid=710612 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.444:2418) : avc: denied { sys_resource } for pid=710612 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.444:2419) : avc: denied { sys_admin } for pid=710612 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.445:2420) : avc: denied { sys_resource } for pid=710612 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:01.445:2421) : avc: denied { sys_admin } for pid=710612 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.451:2422) : avc: denied { sys_resource } for pid=710621 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.451:2423) : avc: denied { sys_admin } for pid=710621 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.453:2424) : avc: denied { sys_resource } for pid=710621 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.453:2425) : avc: denied { sys_admin } for pid=710621 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.454:2426) : avc: denied { sys_resource } for pid=710621 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.454:2427) : avc: denied { sys_admin } for pid=710621 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.456:2428) : avc: denied { sys_resource } for pid=710621 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.456:2429) : avc: denied { sys_admin } for pid=710621 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.457:2430) : avc: denied { sys_resource } for pid=710621 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.457:2431) : avc: denied { sys_admin } for pid=710621 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.459:2432) : avc: denied { sys_resource } for pid=710621 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.459:2433) : avc: denied { sys_admin } for pid=710621 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.461:2434) : avc: denied { sys_resource } for pid=710621 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.461:2435) : avc: denied { sys_admin } for pid=710621 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.462:2436) : avc: denied { sys_resource } for pid=710621 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(17/07/23 03:38:06.462:2437) : avc: denied { sys_admin } for pid=710621 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:15.837:2928) : avc: denied { sys_resource } for pid=1136231 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:15.837:2929) : avc: denied { sys_admin } for pid=1136231 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:15.839:2930) : avc: denied { sys_resource } for pid=1136231 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:15.839:2931) : avc: denied { sys_admin } for pid=1136231 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:15.841:2932) : avc: denied { sys_resource } for pid=1136231 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:15.841:2933) : avc: denied { sys_admin } for pid=1136231 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.849:2936) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.849:2937) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.851:2938) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.851:2939) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.853:2940) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.853:2941) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.855:2942) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.855:2943) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.857:2944) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.857:2945) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.859:2946) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.859:2947) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.861:2948) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.861:2949) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.863:2950) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.863:2951) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.865:2952) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.865:2953) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.867:2954) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.867:2955) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.869:2956) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.869:2957) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.871:2958) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.871:2959) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.872:2960) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.872:2961) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.874:2962) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.874:2963) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.876:2964) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.876:2965) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.878:2966) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.878:2967) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.880:2968) : avc: denied { sys_resource } for pid=1136240 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.880:2969) : avc: denied { sys_admin } for pid=1136240 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.891:2970) : avc: denied { sys_resource } for pid=1136310 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.891:2971) : avc: denied { sys_admin } for pid=1136310 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.892:2972) : avc: denied { sys_resource } for pid=1136310 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.892:2973) : avc: denied { sys_admin } for pid=1136310 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.894:2974) : avc: denied { sys_resource } for pid=1136310 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:20.894:2975) : avc: denied { sys_admin } for pid=1136310 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.900:2976) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.900:2977) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.903:2978) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.903:2979) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.905:2980) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.905:2981) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.907:2982) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.907:2983) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.910:2984) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.910:2985) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.912:2986) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.912:2987) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.914:2988) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.914:2989) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.917:2990) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.917:2991) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.919:2992) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.919:2993) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.921:2994) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.921:2995) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.924:2996) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.924:2997) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.926:2998) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.926:2999) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.928:3000) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.928:3001) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.930:3002) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.930:3003) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.933:3004) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.933:3005) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.936:3006) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.936:3007) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.938:3008) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.938:3009) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.940:3010) : avc: denied { sys_resource } for pid=1136319 comm=sendmail capability=sys_resource scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- type=AVC msg=audit(24/07/23 03:56:25.940:3011) : avc: denied { sys_admin } for pid=1136319 comm=sendmail capability=sys_admin scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tclass=capability permissive=0
Let's wait a week then. Without additional data gathered in full auditing we are unable to assess the problem. The sys_resource cap may be just related to load on the system, but sys_admin is so powerful that it requires justification.
Hi, Any luck with gathering more data or getting a direct reproducer?
As no new information appeared during the past time, we are going to close this bug. If you need to pursue this matter further, feel free to reopen this bug and attach the needed information.
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days