Bug 451631 - Problem with Spamassassin triggered by procmail
Problem with Spamassassin triggered by procmail
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
9
All Linux
low Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-06-16 06:52 EDT by Adam Huffman
Modified: 2008-06-24 06:04 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-06-24 06:04:26 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Alert text from sealert (2.91 KB, text/plain)
2008-06-16 06:52 EDT, Adam Huffman
no flags Details

  None (edit)
Description Adam Huffman 2008-06-16 06:52:54 EDT
Description of problem:
Since upgrading to F9 I've been seeing selinux errors with SpamAssassin, which
is triggered by my .procmailrc.

This causes thousands of AVC messages, meaning I have to shutdown
setroubleshootd in order to make the system usable.

Version-Release number of selected component (if applicable):
selinux-policy-3.3.1-64.fc9.noarch

How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:
Comment 1 Adam Huffman 2008-06-16 06:52:54 EDT
Created attachment 309477 [details]
Alert text from sealert
Comment 2 Daniel Walsh 2008-06-22 08:38:20 EDT
This avc shows spamassassin tryint to bind to a udp socket 32230?

Is this expected behaviour?
Comment 3 Daniel Walsh 2008-06-22 08:40:22 EDT
You can allow this for now.

# audit2allow -M mypol -l -i /var/log/audit/audit.log
# semodule -i mypol.pp
Comment 4 Adam Huffman 2008-06-24 05:52:41 EDT
I'm assuming it's expected behaviour as I'm using SpamAssassin's defaults. 
Here's how it's triggered in .procmailrc:

INCLUDERC=/etc/mail/spamassassin/spamassassin-default.rc

and here's the content of that file:

# send mail through spamassassin
:0fw
| /usr/bin/spamassassin

Here's the content of /etc/sysconfig/spamassassin:

# Options to spamd
SPAMDOPTIONS="-d -c -m5 -H"
Comment 5 Daniel Walsh 2008-06-24 06:04:26 EDT
Turn on the spamassassin_can_network boolean.

If you run your AVC though audit2why it shows


 audit2why -i /tmp/t
host=saintloup.smith.man.ac.uk type=AVC msg=audit(1213613494.259:1224): avc: 
denied  { name_bind } for  pid=5705 comm="spamassassin" src=32230
scontext=system_u:system_r:spamassassin_t:s0
tcontext=system_u:object_r:port_t:s0 tclass=udp_socket

	Was caused by:
	One of the following booleans was set incorrectly.
	Description:
	Allow user spamassassin clients to use the network.

	Allow access by executing:
	# setsebool -P spamassassin_can_network 1
	Description:
	Allow system to run with NIS

	Allow access by executing:
	# setsebool -P allow_ypbind 1


Note You need to log in before you can comment on or make changes to this bug.