Red Hat Bugzilla – Bug 413601
SELinux prevents Postfix from accessing the Postgrey policy service socket
Last modified: 2007-12-06 10:43:11 EST
Description of problem: In permissive mode, SELinux denies the Postfix smtpd process from connecting (and probably writing) to the Postgrey socket. I am using the Fedora 7 Postfix and Postgrey RPMs. Also, the Postgrey socket is probably labeled improperly as it gets the initrc_t type after a reboot. Version-Release number of selected component (if applicable): postfix-2.4.5-2.fc7 postgrey-1.27-4.fc7 selinux-policy-targeted-2.6.4-57.fc7 How reproducible: Each time Postfix is configured to use the Postgrey policy service Actual results: avc: denied { connectto } for comm="smtpd" dev=sda2 egid=89 euid=89 exe="/usr/libexec/postfix/smtpd" exit=0 fsgid=89 fsuid=89 gid=89 items=0 name="socket" path="/var/spool/postfix/postgrey/socket" pid=5176 scontext=system_u:system_r:postfix_smtpd_t:s0 sgid=89 subj=system_u:system_r:postfix_smtpd_t:s0 suid=89 tclass=unix_stream_socket tcontext=system_u:system_r:initrc_t:s0 tty=(none) uid=8 avc: denied { write } for comm="smtpd" dev=sda2 egid=89 euid=89 exe="/usr/libexec/postfix/smtpd" exit=0 fsgid=89 fsuid=89 gid=89 items=0 name="socket" pid=24378 scontext=root:system_r:postfix_smtpd_t:s0 sgid=89 subj=root:system_r:postfix_smtpd_t:s0 suid=89 tclass=sock_file tcontext=root:object_r:postfix_spool_t:s0 tty=(none) uid=89 Expected results: SELinux will allow the Postfix process to use the Postgrey socket.
This is fixed in Fedora 8 I think it is best if you just add custom rules for this using audit2allow. grep postfix /var/log/audit/audit.log | audit2allow -M mypostfix semodule -i mypostfix.pp