Bug 373341 - SELinux prevents saslauthd from authenticating NIS users
Summary: SELinux prevents saslauthd from authenticating NIS users
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 7
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-11-09 18:15 UTC by Leonid Zeitlin
Modified: 2007-12-10 20:55 UTC (History)
0 users

Fixed In Version: Current
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-12-10 20:55:04 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Leonid Zeitlin 2007-11-09 18:15:45 UTC
Description of problem:
Sendmail is configured to allow SMTP AUTH. SMTP authentication is handled by 
saslauthd. The system is configured to use NIS for authentication. When SMTP 
authentication is attempted and valid credentials are supplied, authentication 
fails. AVC denials for saslauthd are logged (only if all audit messages are 
enabled with enableaudit.pp). 

The following SELinux policy rules were found to resolve the situation:

allow saslauthd_t reserved_port_type:udp_socket name_bind;
allow saslauthd_t self:capability net_bind_service;

The issue is similar to issue #320461.

Version-Release number of selected component (if applicable):
selinux-policy-2.6.4-49.fc7
selinux-policy-targeted-2.6.4-49.fc7


How reproducible:
Always

Steps to Reproduce:
1. Enable SMTP AUTH in sendmail.cf
2. Start saslauthd
3. Configure email client to authenticate to SMTP server
4. Attempt to send email. 
  
Actual results:
Valid user credentials are rejected

Expected results:
Valid user credentials are accepted

Additional info:

Comment 1 Daniel Walsh 2007-11-10 12:55:35 UTC
Fixed in selinux-policy-2.6.4-56.fc8

Comment 2 Leonid Zeitlin 2007-12-10 14:57:29 UTC
Sorry for delay in testing. I am now running selinux-policy-2.6.4-59.fc7. The 
issue is fixed.


Note You need to log in before you can comment on or make changes to this bug.