Bug 444313 - AVC denieds by SpamAssassin via MIMEDefang
AVC denieds by SpamAssassin via MIMEDefang
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
9
All Linux
low Severity medium
: ---
: ---
Assigned To: Radek Vokal
Ben Levenson
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-04-26 19:15 EDT by Robert Scheck
Modified: 2008-11-17 17:03 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-11-17 17:03:36 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Robert Scheck 2008-04-26 19:15:42 EDT
Description of problem:
I've several AVC denieds by SpamAssassin when it's invoked by MIMEDefang in a 
normal setup. AFAIK I re-assigned a few other AVC denieds related to MIMDefang
to you in the past:

type=USER_AUTH msg=audit(1209251487.033:192967): user pid=13454 uid=0 auid=500
subj=system_u:system_r:saslauthd_t:s0 msg='op=PAM:authentication acct="robert"
exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
type=USER_ACCT msg=audit(1209251487.037:192968): user pid=13454 uid=0 auid=500
subj=system_u:system_r:saslauthd_t:s0 msg='op=PAM:accounting acct="robert"
exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
type=SELINUX_ERR msg=audit(1209251487.133:192969): security_compute_sid: 
invalid context system_u:system_r:spamassassin_t:s0 for
scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:object_r:spamassassin_exec_t:s0 tclass=process
type=AVC msg=audit(1209251487.133:192969): avc:  denied  { write } for 
pid=11331 comm="spamassassin" path="pipe:[45037403]" dev=pipefs ino=45037403
scontext=system_u:system_r:spamassassin_t:s0
tcontext=system_u:system_r:sendmail_t:s0 tclass=fifo_file
type=AVC msg=audit(1209251487.133:192969): avc:  denied  { read write } for 
pid=11331 comm="spamassassin" path="socket:[45037364]" dev=sockfs ino=45037364
scontext=system_u:system_r:spamassassin_t:s0
tcontext=system_u:system_r:sendmail_t:s0 tclass=unix_stream_socket
type=AVC msg=audit(1209251487.133:192969): avc:  denied  { read } for  pid=11331
comm="spamassassin" path="/var/spool/mqueue/dfm3QNBNwl011323" dev=cciss/c0d0p2
ino=1097746 scontext=system_u:system_r:spamassassin_t:s0
tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=file
type=SYSCALL msg=audit(1209251487.133:192969): arch=40000003 syscall=11
success=yes exit=0 a0=bfd7f964 a1=9d2d968 a2=9d2d920 a3=9d2d9bf items=0
ppid=11330 pid=11331 auid=500 uid=500 gid=100 euid=500 suid=500 fsuid=500
egid=100 sgid=100 fsgid=100 tty=(none) comm="spamassassin" exe="/usr/bin/perl"
subj=system_u:system_r:spamassassin_t:s0 key=(null)
type=AVC msg=audit(1209251487.138:192970): avc:  denied  { ioctl } for 
pid=11331 comm="spamassassin" path="pipe:[45037403]" dev=pipefs ino=45037403
scontext=system_u:system_r:spamassassin_t:s0
tcontext=system_u:system_r:sendmail_t:s0 tclass=fifo_file
type=SYSCALL msg=audit(1209251487.138:192970): arch=40000003 syscall=54
success=no exit=-22 a0=2 a1=5401 a2=bfbf03a8 a3=bfbf03e8 items=0 ppid=11330
pid=11331 auid=500 uid=500 gid=100 euid=500 suid=500 fsuid=500 egid=100 sgid=100
fsgid=100 tty=(none) comm="spamassassin" exe="/usr/bin/perl"
subj=system_u:system_r:spamassassin_t:s0 key=(null)
type=AVC msg=audit(1209251488.814:192971): avc:  denied  { read } for  pid=11331
comm="spamassassin" name="stat" dev=proc ino=4026531853
scontext=system_u:system_r:spamassassin_t:s0
tcontext=system_u:object_r:proc_t:s0 tclass=file
type=SYSCALL msg=audit(1209251488.814:192971): arch=40000003 syscall=5
success=yes exit=4 a0=5835fd a1=0 a2=1b6 a3=5835fd items=0 ppid=11330 pid=11331
auid=500 uid=500 gid=100 euid=500 suid=500 fsuid=500 egid=100 sgid=100 fsgid=100
tty=(none) comm="spamassassin" exe="/usr/bin/perl"
subj=system_u:system_r:spamassassin_t:s0 key=(null)
type=AVC msg=audit(1209251488.814:192972): avc:  denied  { getattr } for 
pid=11331 comm="spamassassin" path="/proc/stat" dev=proc ino=4026531853
scontext=system_u:system_r:spamassassin_t:s0
tcontext=system_u:object_r:proc_t:s0 tclass=file
type=SYSCALL msg=audit(1209251488.814:192972): arch=40000003 syscall=197
success=yes exit=0 a0=4 a1=bfbee0b8 a2=5aeff4 a3=8ea9078 items=0 ppid=11330
pid=11331 auid=500 uid=500 gid=100 euid=500 suid=500 fsuid=500 egid=100 sgid=100
fsgid=100 tty=(none) comm="spamassassin" exe="/usr/bin/perl"
subj=system_u:system_r:spamassassin_t:s0 key=(null)
type=AVC msg=audit(1209251488.826:192973): avc:  denied  { name_bind } for 
pid=11331 comm="spamassassin" src=17769
scontext=system_u:system_r:spamassassin_t:s0
tcontext=system_u:object_r:port_t:s0 tclass=udp_socket
type=AVC msg=audit(1209251488.826:192973): avc:  denied  { node_bind } for 
pid=11331 comm="spamassassin" src=17769
scontext=system_u:system_r:spamassassin_t:s0
tcontext=system_u:object_r:inaddr_any_node_t:s0 tclass=udp_socket
type=SYSCALL msg=audit(1209251488.826:192973): arch=40000003 syscall=102
success=yes exit=0 a0=2 a1=bfbf06f0 a2=39b4d4 a3=10 items=0 ppid=11330 pid=11331
auid=500 uid=500 gid=100 euid=500 suid=500 fsuid=500 egid=100 sgid=100 fsgid=100
tty=(none) comm="spamassassin" exe="/usr/bin/perl"
subj=system_u:system_r:spamassassin_t:s0 key=(null)
type=AVC msg=audit(1209251489.485:192974): avc:  denied  { read } for  pid=11331
comm="spamassassin" name="stat" dev=proc ino=4026531853
scontext=system_u:system_r:spamassassin_t:s0
tcontext=system_u:object_r:proc_t:s0 tclass=file
type=SYSCALL msg=audit(1209251489.485:192974): arch=40000003 syscall=5
success=yes exit=4 a0=5835fd a1=0 a2=1b6 a3=5835fd items=0 ppid=11330 pid=11331
auid=500 uid=500 gid=100 euid=500 suid=500 fsuid=500 egid=100 sgid=100 fsgid=100
tty=(none) comm="spamassassin" exe="/usr/bin/perl"
subj=system_u:system_r:spamassassin_t:s0 key=(null)
type=AVC msg=audit(1209251489.486:192975): avc:  denied  { getattr } for 
pid=11331 comm="spamassassin" path="/proc/stat" dev=proc ino=4026531853
scontext=system_u:system_r:spamassassin_t:s0
tcontext=system_u:object_r:proc_t:s0 tclass=file
type=SYSCALL msg=audit(1209251489.486:192975): arch=40000003 syscall=197
success=yes exit=0 a0=4 a1=bfbee0b8 a2=5aeff4 a3=9748058 items=0 ppid=11330
pid=11331 auid=500 uid=500 gid=100 euid=500 suid=500 fsuid=500 egid=100 sgid=100
fsgid=100 tty=(none) comm="spamassassin" exe="/usr/bin/perl"
subj=system_u:system_r:spamassassin_t:s0 key=(null)

Version-Release number of selected component (if applicable):
selinux-policy-3.3.1-42

How reproducible:
Everytime.

Actual results:
AVC denieds by SpamAssassin via MIMEDefang

Expected results:
No AVC denieds any longer... ;-)
Comment 1 Daniel Walsh 2008-04-28 17:57:05 EDT
mimedefang needs a policy written for it.
Comment 2 Robert Scheck 2008-04-29 16:07:54 EDT
Is it hard for you to work out a suitable policy for mimedefang? Because writing
a hackish policy for a third party software was a bigger thing for me...
Comment 3 Daniel Walsh 2008-04-30 08:37:57 EDT
just a matter of time.

Josef, 

Could you take a stab at writing policy for MIMEDefang?
Comment 4 Robert Scheck 2008-04-30 09:10:55 EDT
Of course I'm willing to test and report etc.
Comment 5 Josef Kubin 2008-04-30 11:30:43 EDT
Hello Dan, of course :-)
Comment 6 Bug Zapper 2008-05-14 06:14:18 EDT
Changing version to '9' as part of upcoming Fedora 9 GA.
More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 7 Kostas Georgiou 2008-05-24 12:52:12 EDT
I got a similar AVC to [1] in #448221 most likely you need a similar one so
procmail can call spamassassin. 

[1] type=SELINUX_ERR msg=audit(1209251487.133:192969): security_compute_sid:
invalid context system_u:system_r:spamassassin_t:s0 for
scontext=system_u:system_r:procmail_t:s0
tcontext=system_u:object_r:spamassassin_exec_t:s0 tclass=process
Comment 8 Daniel Walsh 2008-07-02 15:45:57 EDT
Fixed in selinux-policy-3.3.1-72.fc9.noarch
Comment 9 Tony Fu 2008-10-05 21:28:23 EDT
User jkubin@redhat.com's account has been closed
Comment 10 Daniel Walsh 2008-11-17 17:03:36 EST
Closing all bugs that have been in modified for over a month.  Please reopen if the bug is not actually fixed.

Note You need to log in before you can comment on or make changes to this bug.