Bug 457307 - can't run dovecot's deliver from inside .procmailrc
can't run dovecot's deliver from inside .procmailrc
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy (Show other bugs)
5.2
All Linux
low Severity low
: rc
: ---
Assigned To: Daniel Walsh
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-07-30 16:16 EDT by John W. Linville
Modified: 2009-01-20 16:32 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-01-20 16:32:15 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description John W. Linville 2008-07-30 16:16:10 EDT
Description of problem:

Using procmail to deliver incoming email, piping messages to dovecot's deliver
program for delivering to folders with proper indexing.  All messages get
delivered to the default mailbox instead.

Procmail log looks like this:

From linville@tuxdriver.com Wed Jul 30 16:00:19 2008
 Subject: Re: [usb-storage] BUG: SCSI: usb storage SDHC card doesn't work in
  Folder: /usr/libexec/dovecot/deliver -m linux-scsi			   4622
/bin/sh: /usr/libexec/dovecot/deliver: Permission denied

/var/log/audit/audit.log has corresponding entries that look like this:

type=AVC msg=audit(1217446216.915:34416): avc:  denied  { execute } for 
pid=25398 comm="procmail" name="deliver" dev=dm-0 ino=4522192
scontext=user_u:system_r:procmail_t:s0
tcontext=system_u:object_r:dovecot_deliver_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1217446216.915:34416): arch=40000003 syscall=11
success=no exit=-13 a0=919bd78 a1=919d5b8 a2=919d5e8 a3=2 items=0 ppid=25394
pid=25398 auid=10 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500
fsgid=500 tty=(none) comm="procmail" exe="/usr/bin/procmail"
subj=user_u:system_r:procmail_t:s0 key=(null)

Version-Release number of selected component (if applicable):

selinux-policy-2.4.6-137.1.el5
exim-4.63-3.el5
procmail-3.22-17.1.el5.centos
dovecot-1.0.7-2.el5

How reproducible:

Every message destined for a folder.

Steps to Reproduce:
1. Install mail server w/ above components.
2. Create .procmailrc that uses "| /usr/libexec/dovecot/deliver -m foldername"
3. Send email that hits the procmail recipe to the account in question.
  
Actual results:

All mail delivered to default mailbox.

Expected results:

Mail delivered to folder as directed by procmail.

Additional info:

FWIW, calling 'deliver -m folder' from a bash shell works just fine.  Also, in
case it matters this is a CentOS box.
Comment 1 Daniel Walsh 2008-07-30 16:19:52 EDT
Fixed in selinux-policy-2.4.6-143.el5
Comment 2 RHEL Product and Program Management 2008-07-30 16:20:36 EDT
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.
Comment 7 Daniel Walsh 2008-08-05 17:27:35 EDT
  Finished building.
  I have to wait to get all of the Acks before I can build.

    Package is built.

    Preview available on 

    http://people.redhat.com/dwalsh/SELinux/RHEL5
Comment 9 errata-xmlrpc 2009-01-20 16:32:15 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2009-0163.html

Note You need to log in before you can comment on or make changes to this bug.