Bug 323251 - After some selinux update php stopped sending e-mails
Summary: After some selinux update php stopped sending e-mails
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 7
Hardware: x86_64
OS: Linux
low
high
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-10-08 16:19 UTC by Ondrej Svetlik
Modified: 2007-11-30 22:12 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-10-09 15:04:22 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Ondrej Svetlik 2007-10-08 16:19:32 UTC
Description of problem:
On my webserver everything worked fine with selinux in Enforcing mode. But after
one of updates, selinux makes PHP to log:
sh: /usr/sbin/sendmail: Permission denied
And no mail is sent.

Version-Release number of selected component (if applicable):
selinux-policy-2.6.4-46.fc7
selinux-policy-targeted-2.6.4-46.fc7
sendmail-8.14.1-4.2.fc7
httpd-2.2.6-1.fc7
php-eaccelerator-0.9.5.1-3.fc7
php-bcmath-5.2.4-1.fc7
php-mysql-5.2.4-1.fc7
php-gd-5.2.4-1.fc7
php-xml-5.2.4-1.fc7
php-5.2.4-1.fc7
php-pecl-xdebug-2.0.0-2.fc7
php-Smarty-2.6.18-1.fc7
php-channel-phpunit-1.0-2.fc7
php-pgsql-5.2.4-1.fc7
php-pdo-5.2.4-1.fc7
php-cli-5.2.4-1.fc7
php-common-5.2.4-1.fc7
php-mbstring-5.2.4-1.fc7
php-ldap-5.2.4-1.fc7


How reproducible:
always


Steps to Reproduce:
1.setenfore Enforcing
2.access a PHP page that sends an e-mail (mail() or pear's Mail)
3.I tried to set Mail to use SMTP, but there was also Permission denied error
while connecting to the port.

Actual results:
in error_log appears a line:
sh: /usr/sbin/sendmail: Permission denied
and no mail


Expected results:
No error in the log and a mail being sent.

Comment 1 Ondrej Svetlik 2007-10-08 16:21:30 UTC
from php.ini:
sendmail_path = "/usr/sbin/sendmail -t -i -O DeliveryMode=q"


Comment 2 Daniel Walsh 2007-10-09 14:53:25 UTC
Do you have the httpd_can_sendmail boolean turned on ?

getsebool -a | grep send
httpd_can_sendmail --> on


setsebool -P httpd_can_sendmail 1

Will turn it on.

Comment 3 Ondrej Svetlik 2007-10-09 15:04:22 UTC
Oh, I don't :-). Thanks a lot.


Note You need to log in before you can comment on or make changes to this bug.