Description of problem:

# sealert -l a10bd899-5e86-4d15-866d-bc5b2664aa68
Summary
    SELinux is preventing /usr/libexec/postfix/local (postfix_local_t) "read" to
    tmp (var_t).

Detailed Description
    SELinux denied access requested by /usr/libexec/postfix/local. It is not
    expected that this access is required by /usr/libexec/postfix/local and this
    access may signal an intrusion attempt. It is also possible that the
    specific version or configuration of the application is causing it to
    require additional access.

Allowing Access
    Sometimes labeling problems can cause SELinux denials.  You could try to
    restore the default system file context for tmp, restorecon -v tmp If this
    does not work, there is currently no automatic way to allow this access.
    Instead,  you can generate a local policy module to allow this access - see
    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
    SELinux protection altogether. Disabling SELinux protection is not
    recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
    against this package.

Additional Information        

Source Context                system_u:system_r:postfix_local_t
Target Context                root:object_r:var_t
Target Objects                tmp [ lnk_file ]
Affected RPM Packages         postfix-2.3.3-2 [application]filesystem-2.4.0-1
                              [target]
Policy RPM                    selinux-policy-2.4.6-106.el5_1.3
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   plugins.catchall_file
Host Name                     europa.iwu.edu
Platform                      Linux europa.iwu.edu 2.6.18-53.1.4.el5 #1 SMP Wed
                              Nov 14 10:37:27 EST 2007 x86_64 x86_64
Alert Count                   32
Line Numbers                  

Raw Audit Messages            

avc: denied { read } for comm="local" dev=dm-2 egid=0 euid=0
exe="/usr/libexec/postfix/local" exit=-13 fsgid=0 fsuid=0 gid=0 items=0
name="tmp" pid=29355 scontext=system_u:system_r:postfix_local_t:s0 sgid=0
subj=system_u:system_r:postfix_local_t:s0 suid=0 tclass=lnk_file
tcontext=root:object_r:var_t:s0 tty=(none) uid=0


Version-Release number of selected component (if applicable):
selinux-policy-2.4.6-106.el5_1.3


How reproducible: happens rather often


Steps to Reproduce:
1. let postfix run for a while
2. send an email through it
3. check syslog
  
Actual results:
SELinux error, doesn't seem to hinder functionality, but it shouldn't be
erroring out either

Expected results:
No SELinux errors

Additional info:
/etc/postfix/main.cf
queue_directory = /var/spool/postfix

command_directory = /usr/sbin

daemon_directory = /usr/libexec/postfix

mail_owner = postfix

inet_interfaces = localhost

mydestination = $myhostname, localhost.$mydomain, localhost

unknown_local_recipient_reject_code = 550

relayhost = smtp.iwu.edu

alias_maps = hash:/etc/aliases

alias_database = hash:/etc/aliases

debug_peer_level = 2

debugger_command =
         PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
         xxgdb $daemon_directory/$process_name $process_id & sleep 5

sendmail_path = /usr/sbin/sendmail.postfix

newaliases_path = /usr/bin/newaliases.postfix

mailq_path = /usr/bin/mailq.postfix

setgid_group = postdrop

html_directory = no

manpage_directory = /usr/share/man

sample_directory = /usr/share/doc/postfix-2.3.3/samples

readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES

This system only sends administrative emails, no user emails are relayed through it.