Description of problem: When running the strict policy, executing "newaliases" fails and generates a SELINUX_ERR message in /var/log/audit/audit.log Version-Release number of selected component (if applicable): Strict Policy version 21 + postfix-2.3.3-2 How reproducible: My system is a relatively clean install. It's consistently reproducible. Steps to Reproduce: 1. root user as sysadm_r execute newaliases 2. 3. Actual results: To standard error: newaliases: fatal: execv /usr/sbin/postalias: Permission denied To /var/log/audit/audit.log type=SELINUX_ERR msg=audit(1202239864.642:2547): security_compute_sid: invalid context root:system_r:sysadm_mail_t:s0-s0:c0.c1023 for scontext=root:sysadm_r:sysadm_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:postfix_master_exec_t:s0 tclass=process type=SYSCALL msg=audit(1202239864.642:2547): arch=40000003 syscall=11 success=no exit=-13 a0=8996368 a1=8996388 a2=8996478 a3=8996368 items=0 ppid=11046 pid=11317 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="newaliases" exe="/usr/sbin/sendmail.postfix" subj=root:sysadm_r:sysadm_mail_t:s0-s0:c0.c1023 key=(null) Expected results: newaliases command completes successfully Additional info:
You need to add a role rule to your policy to make this work. role sysadm_r types postfix_master_exec_t; You can add this via a policy module. Or run_init newaliases might work. strict policy is not supported via normal contract so it is not likely this fix will be forth coming.