Red Hat Bugzilla – Bug 466235
SELinux is preventing master (postfix_master_t) "write" to ./postfix (var_lib_t)
Last modified: 2008-11-26 12:37:51 EST
Description of problem: After update, postfix refuses to start, with selinux error Version-Release number of selected component (if applicable): postfix-2.5.5-1.fc8.i386 How reproducible: Steps to Reproduce: 1. yum update postfix 2. 3. Actual results: Oct 9 09:44:58 pigeon setroubleshoot: SELinux is preventing master (postfix_master_t) "write" to ./postfix (var_lib_t). For complete SELinux messages. run sealert -l 248b64c2-270e-4ed2-b2ab-7c03ade2c8b6 Expected results: postfix to start without errors Additional info: [root@pigeon lib]# ls -ldZ /var/lib/postfix/ drwx------ postfix root system_u:object_r:var_lib_t:s0 /var/lib/postfix/ [root@pigeon lib]# sealert -l 248b64c2-270e-4ed2-b2ab-7c03ade2c8b6 Summary: SELinux is preventing master (postfix_master_t) "write" to ./postfix (var_lib_t). Detailed Description: SELinux is preventing master (postfix_master_t) "write" to ./postfix (var_lib_t). The SELinux type var_lib_t, is a generic type for all files in the directory and very few processes (SELinux Domains) are allowed to write to this SELinux type. This type of denial usual indicates a mislabeled file. By default a file created in a directory has the gets the context of the parent directory, but SELinux policy has rules about the creation of directories, that say if a process running in one SELinux Domain (D1) creates a file in a directory with a particular SELinux File Context (F1) the file gets a different File Context (F2). The policy usually allows the SELinux Domain (D1) the ability to write, unlink, and append on (F2). But if for some reason a file (./postfix) was created with the wrong context, this domain will be denied. The usual solution to this problem is to reset the file context on the target file, restorecon -v './postfix'. If the file context does not change from var_lib_t, then this is probably a bug in policy. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy package. If it does change, you can try your application again to see if it works. The file context could have been mislabeled by editing the file or moving the file from a different directory, if the file keeps getting mislabeled, check the init scripts to see if they are doing something to mislabel the file. Allowing Access: You can attempt to fix file context by executing restorecon -v './postfix' The following command will allow this access: restorecon './postfix' Additional Information: Source Context system_u:system_r:postfix_master_t:s0 Target Context system_u:object_r:var_lib_t:s0 Target Objects ./postfix [ dir ] Source master Source Path /usr/libexec/postfix/master Port <Unknown> Host pigeon Source RPM Packages postfix-2.5.5-1.fc8 Target RPM Packages Policy RPM selinux-policy-3.0.8-117.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name mislabeled_file Host Name pigeon Platform Linux pigeon 2.6.26.5-28.fc8 #1 SMP Sat Sep 20 09:32:58 EDT 2008 i686 i686 Alert Count 1 First Seen Thu Oct 9 09:44:58 2008 Last Seen Thu Oct 9 09:44:58 2008 Local ID 248b64c2-270e-4ed2-b2ab-7c03ade2c8b6 Line Numbers Raw Audit Messages host=pigeon type=AVC msg=audit(1223541898.350:448): avc: denied { write } for pid=8231 comm="master" name="postfix" dev=dm-2 ino=1900694 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir host=pigeon type=SYSCALL msg=audit(1223541898.350:448): arch=40000003 syscall=5 success=no exit=-13 a0=b8985850 a1=c2 a2=1a4 a3=0 items=0 ppid=1 pid=8231 auid=500 uid=0 gid=0 euid=89 suid=0 fsuid=89 egid=89 sgid=0 fsgid=89 tty=(none) ses=2 comm="master" exe="/usr/libexec/postfix/master" subj=system_u:system_r:postfix_master_t:s0 key=(null) [root@pigeon lib]#
The context for /var/lib/postfix needs to get changed in selinux-policy-targeted for the new postfix package. As an interim solution you could set the context of /var/lib/postfix to system_u:object_r:postfix_var_lib_t:s0 with chcon. Reassigning to selinux-policy-targeted.
Except, the context system_u:object_r:postfix_var_lib_t:s0 doesn't exist in the current Fedora 8 selinux-policy-targeted package so doing that will fail.
There is a magic dance some nice person (domg472) in #selinux gave me: First, make sure selinux-policy-devel is installed. mkdir ~/mypostfix cd ~/mypostfix vi mypostfix.te ------- policy_module(mypostfix, 0.0.1) type postfix_var_lib_t; files_type(postfix_var_lib_t) require { type postfix_master_t; } manage_dirs_pattern(postfix_master_t, postfix_var_lib_t, postfix_var_lib_t) manage_files_pattern(postfix_master_t, postfix_var_lib_t, postfix_var_lib_t) files_search_var_lib(postfix_master_t) ------- make -f /usr/share/selinux/devel/Makefile /usr/sbin/semodule -i mypostfix.pp /usr/sbin/semanage fcontext -a -t postfix_var_lib_t "/var/lib/postfix(/.*)?" restorecon -vR /var/lib/postfix
That hack has taken me a bit further; now I get a new error trying to start postfix: Oct 11 17:45:39 pigeon setroubleshoot: SELinux is preventing postfix (sendmail_t) "execute" to ./postfix-script (postfix_exec_t). For complete SELinux messages. run sealert -l b5b91e16-8a62-499a-bfd2-7c875c8d256e [root@pigeon mypostfix]# ls -lZ /etc/postfix/postfix-script -rwxr-xr-x root root system_u:object_r:postfix_exec_t:s0 /etc/postfix/postfix-script [root@pigeon mypostfix]# sealert -l b5b91e16-8a62-499a-bfd2-7c875c8d256e Summary: SELinux is preventing postfix (sendmail_t) "execute" to ./postfix-script (postfix_exec_t). Detailed Description: SELinux denied access requested by postfix. It is not expected that this access is required by postfix and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./postfix-script, restorecon -v './postfix-script' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:sendmail_t:s0 Target Context system_u:object_r:postfix_exec_t:s0 Target Objects ./postfix-script [ file ] Source postfix Source Path /usr/sbin/postfix Port <Unknown> Host pigeon Source RPM Packages postfix-2.5.5-1.fc8 Target RPM Packages Policy RPM selinux-policy-3.0.8-117.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name pigeon Platform Linux pigeon 2.6.26.5-28.fc8 #1 SMP Sat Sep 20 09:32:58 EDT 2008 i686 i686 Alert Count 3 First Seen Sat Oct 11 17:37:56 2008 Last Seen Sat Oct 11 17:45:39 2008 Local ID b5b91e16-8a62-499a-bfd2-7c875c8d256e Line Numbers Raw Audit Messages host=pigeon type=AVC msg=audit(1223743539.224:781): avc: denied { execute } for pid=521 comm="postfix" name="postfix-script" dev=dm-2 ino=1836888 scontext=system_u:system_r:sendmail_t:s0 tcontext=system_u:object_r:postfix_exec_t:s0 tclass=file host=pigeon type=SYSCALL msg=audit(1223743539.224:781): arch=40000003 syscall=11 success=no exit=-13 a0=b9052c30 a1=bff71604 a2=b9052b50 a3=b9052c30 items=0 ppid=1 pid=521 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=2 comm="postfix" exe="/usr/sbin/postfix" subj=system_u:system_r:sendmail_t:s0 key=(null)
ignore my previous comment. For some reason I was typing service sendmail start rather than service postfix start D'oh! Works now.
*** Bug 466609 has been marked as a duplicate of this bug. ***
*** Bug 466664 has been marked as a duplicate of this bug. ***
I believe this might be fixed in selinux-policy-3.0.8-118.fc8 I have upgraded to the f9 policy for postfix. The real problem here might be that you have the postfix executable running as sendmail_t?
No, if you look carefully at the comments, Dave and I both got bitten by the lack of a postfix_var_lib_t and associated rules. The instructions in Comment #3 fixed that for me and Dave both. However, as Dave explained in Comment #5, he thought he had other problems on top of that, but was typing the wrong command. If there is any lingering doubt: $ ps -eo user,label,command|grep postfix|grep -v grep root unconfined_u:system_r:postfix_master_t /usr/libexec/postfix/master postfix unconfined_u:system_r:postfix_qmgr_t qmgr -l -t fifo -u postfix unconfined_u:system_r:postfix_pickup_t pickup -l -t fifo -u (unconfined_u because I started the service after bootup, due to the aforementioned selinux-policy-targeted bug). What I'm curious about is how to handle the custom policy/fcontext rules when the new update is installed. Will the custom policy/fcontext rules get thrown out? Will it conflict? Will I need to uninstall it first?
Ok I looked again and made an update to selinux-policy-3.0.8-119.fc8 WHich allows sendmail_t to transition to postfix_master_t as it does in F9 and F10. This package should be in Fedora Testing soon, or you can grab it from koji.
This message is a reminder that Fedora 8 is nearing its end of life. Approximately 30 (thirty) days from now Fedora will stop maintaining and issuing updates for Fedora 8. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '8'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 8's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 8 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora please change the 'version' of this bug to the applicable version. If you are unable to change the version, please add a comment here and someone will do it for you. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping
As this bug is in MODIFIED, Fedora believes that a fix has been committed that resolves the problem listed in this bug report. If this is not the case, please re-open this report, noting the version of the package that you reproduced the bug against. Thanks for the report!