Description of problem: Using procmail to deliver incoming email, piping messages to dovecot's deliver program for delivering to folders with proper indexing. All messages get delivered to the default mailbox instead. Procmail log looks like this: From linville Wed Jul 30 16:00:19 2008 Subject: Re: [usb-storage] BUG: SCSI: usb storage SDHC card doesn't work in Folder: /usr/libexec/dovecot/deliver -m linux-scsi 4622 /bin/sh: /usr/libexec/dovecot/deliver: Permission denied /var/log/audit/audit.log has corresponding entries that look like this: type=AVC msg=audit(1217446216.915:34416): avc: denied { execute } for pid=25398 comm="procmail" name="deliver" dev=dm-0 ino=4522192 scontext=user_u:system_r:procmail_t:s0 tcontext=system_u:object_r:dovecot_deliver_exec_t:s0 tclass=file type=SYSCALL msg=audit(1217446216.915:34416): arch=40000003 syscall=11 success=no exit=-13 a0=919bd78 a1=919d5b8 a2=919d5e8 a3=2 items=0 ppid=25394 pid=25398 auid=10 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) comm="procmail" exe="/usr/bin/procmail" subj=user_u:system_r:procmail_t:s0 key=(null) Version-Release number of selected component (if applicable): selinux-policy-2.4.6-137.1.el5 exim-4.63-3.el5 procmail-3.22-17.1.el5.centos dovecot-1.0.7-2.el5 How reproducible: Every message destined for a folder. Steps to Reproduce: 1. Install mail server w/ above components. 2. Create .procmailrc that uses "| /usr/libexec/dovecot/deliver -m foldername" 3. Send email that hits the procmail recipe to the account in question. Actual results: All mail delivered to default mailbox. Expected results: Mail delivered to folder as directed by procmail. Additional info: FWIW, calling 'deliver -m folder' from a bash shell works just fine. Also, in case it matters this is a CentOS box.
Fixed in selinux-policy-2.4.6-143.el5
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux maintenance release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Update release for currently deployed products. This request is not yet committed for inclusion in an Update release.
Finished building. I have to wait to get all of the Acks before I can build. Package is built. Preview available on http://people.redhat.com/dwalsh/SELinux/RHEL5
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2009-0163.html