Bug 312821 - SELinux is preventing spamd (spamd_t) "write" to / (root_t)
SELinux is preventing spamd (spamd_t) "write" to / (root_t)
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
i386 Linux
low Severity urgent
: ---
: ---
Assigned To: Daniel Walsh
Ben Levenson
Depends On:
  Show dependency treegraph
Reported: 2007-09-29 22:09 EDT by Dave
Modified: 2007-12-26 18:34 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-12-26 18:34:01 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Dave 2007-09-29 22:09:44 EDT
Detailed Description
    SELinux is preventing spamd (spamd_t) "write" to / (root_t). The SELinux
    type %TARGET_TYPE, is a generic type for all files in the directory and very
    few processes (SELinux Domains) are allowed to write to this SELinux type.
    This type of denial usual indicates a mislabeled file.  By default a file
    created in a directory has the gets the context of the parent directory, but
    SELinux policy has rules about the creation of directories, that say if a
    process running in one SELinux Domain (D1) creates a file in a directory
    with a particular SELinux File Context (F1) the file gets a different File
    Context (F2).  The policy usually allows the SELinux Domain (D1) the ability
    to write or append on (F2).  But if for some reason a file (/) was created
    with the wrong context, this domain will be denied.  The usual solution to
    this problem is to reset the file context on the target file, restorecon -v
    /.  If the file context does not change from root_t, then this is probably a
    bug in policy.  Please file a
    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against the selinux-policy
    package. If it does change, you can try your application again to see if it
    works.  The file context could have been mislabeled by editing the file or
    moving the file from a different directory, if the file keeps getting
    mislabeled, check the init scripts to see if they are doing something to
    mislabel the file.

Allowing Access
    You can attempt to fix file context by executing restorecon -v /

    The following command will allow this access:
    restorecon /

Additional Information        

Source Context                system_u:system_r:spamd_t
Target Context                system_u:object_r:root_t
Target Objects                / [ dir ]
Affected RPM Packages         filesystem-2.4.6-1.fc7 [target]
Policy RPM                    selinux-policy-2.6.4-35.fc7
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   plugins.mislabeled_file
Host Name                     home.supercaregistry.info
Platform                      Linux home.supercaregistry.info #1
                              SMP Fri Jul 27 18:10:34 EDT 2007 i686 i686
Alert Count                   1
First Seen                    Tue 14 Aug 2007 08:07:01 PM MST
Last Seen                     Tue 14 Aug 2007 08:07:01 PM MST
Local ID                      83b1957f-ddcf-4d24-b41c-a900fd85e197
Line Numbers                  

Raw Audit Messages            

avc: denied { write } for comm="spamd" dev=dm-0 egid=0 euid=0
exe="/usr/bin/perl" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name="/" pid=3359
scontext=system_u:system_r:spamd_t:s0 sgid=0 subj=system_u:system_r:spamd_t:s0
suid=0 tclass=dir tcontext=system_u:object_r:root_t:s0 tty=(none) uid=0
Comment 1 Daniel Walsh 2007-12-26 18:34:01 EST
This looks like you have  a mislabeled file system.  Or spamd is trying to write
files in /?  The only file/directory on your machine which should be labeled
root_t is /.  ls -lZ / will show you the labels of directrories under /.

If you see a directory labeled root_t, you can fix its labeling by executing
restorecon -R -v /DIR
If you want to fix the labeling of your entire system .
You can fix the labeling by executing touch /.autorelabel; reboot

Note You need to log in before you can comment on or make changes to this bug.