Bug 435455 - Basic postfix configuration is causing SELinux errors
Basic postfix configuration is causing SELinux errors
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy (Show other bugs)
All Linux
low Severity medium
: rc
: ---
Assigned To: Daniel Walsh
Depends On:
  Show dependency treegraph
Reported: 2008-02-29 09:25 EST by Pat Riehecky
Modified: 2008-02-29 13:25 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-02-29 13:25:04 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Pat Riehecky 2008-02-29 09:25:38 EST
Description of problem:

# sealert -l a10bd899-5e86-4d15-866d-bc5b2664aa68
    SELinux is preventing /usr/libexec/postfix/local (postfix_local_t) "read" to
    tmp (var_t).

Detailed Description
    SELinux denied access requested by /usr/libexec/postfix/local. It is not
    expected that this access is required by /usr/libexec/postfix/local and this
    access may signal an intrusion attempt. It is also possible that the
    specific version or configuration of the application is causing it to
    require additional access.

Allowing Access
    Sometimes labeling problems can cause SELinux denials.  You could try to
    restore the default system file context for tmp, restorecon -v tmp If this
    does not work, there is currently no automatic way to allow this access.
    Instead,  you can generate a local policy module to allow this access - see
    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
    SELinux protection altogether. Disabling SELinux protection is not
    recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
    against this package.

Additional Information        

Source Context                system_u:system_r:postfix_local_t
Target Context                root:object_r:var_t
Target Objects                tmp [ lnk_file ]
Affected RPM Packages         postfix-2.3.3-2 [application]filesystem-2.4.0-1
Policy RPM                    selinux-policy-2.4.6-106.el5_1.3
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   plugins.catchall_file
Host Name                     europa.iwu.edu
Platform                      Linux europa.iwu.edu 2.6.18-53.1.4.el5 #1 SMP Wed
                              Nov 14 10:37:27 EST 2007 x86_64 x86_64
Alert Count                   32
Line Numbers                  

Raw Audit Messages            

avc: denied { read } for comm="local" dev=dm-2 egid=0 euid=0
exe="/usr/libexec/postfix/local" exit=-13 fsgid=0 fsuid=0 gid=0 items=0
name="tmp" pid=29355 scontext=system_u:system_r:postfix_local_t:s0 sgid=0
subj=system_u:system_r:postfix_local_t:s0 suid=0 tclass=lnk_file
tcontext=root:object_r:var_t:s0 tty=(none) uid=0

Version-Release number of selected component (if applicable):

How reproducible: happens rather often

Steps to Reproduce:
1. let postfix run for a while
2. send an email through it
3. check syslog
Actual results:
SELinux error, doesn't seem to hinder functionality, but it shouldn't be
erroring out either

Expected results:
No SELinux errors

Additional info:
queue_directory = /var/spool/postfix

command_directory = /usr/sbin

daemon_directory = /usr/libexec/postfix

mail_owner = postfix

inet_interfaces = localhost

mydestination = $myhostname, localhost.$mydomain, localhost

unknown_local_recipient_reject_code = 550

relayhost = smtp.iwu.edu

alias_maps = hash:/etc/aliases

alias_database = hash:/etc/aliases

debug_peer_level = 2

debugger_command =
         xxgdb $daemon_directory/$process_name $process_id & sleep 5

sendmail_path = /usr/sbin/sendmail.postfix

newaliases_path = /usr/bin/newaliases.postfix

mailq_path = /usr/bin/mailq.postfix

setgid_group = postdrop

html_directory = no

manpage_directory = /usr/share/man

sample_directory = /usr/share/doc/postfix-2.3.3/samples

readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES

This system only sends administrative emails, no user emails are relayed through it.
Comment 1 Daniel Walsh 2008-02-29 11:42:53 EST
THis looks like local customization of your file system.  postfix_local is
trying to read a symbolic link file in /var named tmp?

You can add this policy by executing

grep postfix /var/log/audit/audit.log | audit2allow -M mypostfix
semodule -i mypostfix.pp
Comment 2 Pat Riehecky 2008-02-29 11:50:22 EST
Hmm... so it is, I will have to go stab someone now.... 

Sorry about that.

Note You need to log in before you can comment on or make changes to this bug.