Summary: SELinux is preventing /usr/sbin/exim "dac_override" access . Detailed Description: [sendmail has a permissive type (logwatch_mail_t). This access was not denied.] SELinux denied access requested by sendmail. It is not expected that this access is required by sendmail and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context system_u:system_r:logwatch_mail_t:s0-s0:c0.c1023 Target Context system_u:system_r:logwatch_mail_t:s0-s0:c0.c1023 Target Objects None [ capability ] Source sendmail Source Path /usr/sbin/exim Port <Unknown> Host (removed) Source RPM Packages exim-4.72-1.fc13 Target RPM Packages Policy RPM selinux-policy-3.7.19-41.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.33.6-147.fc13.x86_64 #1 SMP Tue Jul 6 22:32:17 UTC 2010 x86_64 x86_64 Alert Count 4 First Seen Wed 28 Jul 2010 08:17:03 IST Last Seen Wed 28 Jul 2010 08:17:03 IST Local ID 6db01112-d739-4f12-9eca-685c0ec6d9e0 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1280301423.798:31186): avc: denied { dac_override } for pid=4529 comm="sendmail" capability=1 scontext=system_u:system_r:logwatch_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:logwatch_mail_t:s0-s0:c0.c1023 tclass=capability node=(removed) type=AVC msg=audit(1280301423.798:31186): avc: denied { dac_read_search } for pid=4529 comm="sendmail" capability=2 scontext=system_u:system_r:logwatch_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:logwatch_mail_t:s0-s0:c0.c1023 tclass=capability node=(removed) type=SYSCALL msg=audit(1280301423.798:31186): arch=c000003e syscall=80 success=yes exit=128 a0=7f2402ddcc60 a1=7fff4371db20 a2=0 a3=7fff4371d890 items=0 ppid=4479 pid=4529 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="sendmail" exe="/usr/sbin/exim" subj=system_u:system_r:logwatch_mail_t:s0-s0:c0.c1023 key=(null) Hash String generated from catchall,sendmail,logwatch_mail_t,logwatch_mail_t,capability,dac_override audit2allow suggests: #============= logwatch_mail_t ============== allow logwatch_mail_t self:capability { dac_read_search dac_override };
Can you add this command auditctl -w /etc/shadow -p w And see if you can generate the error again. Then you should get a path with the next avc message. Please attach the message
Created attachment 435223 [details] sealert dac_override
(In reply to comment #1) > Can you add this command > > auditctl -w /etc/shadow -p w > > And see if you can generate the error again. Then you should get a path with > the next avc message. > > Please attach the message Ran the command last night as root (su), hope that was correct. Attached is the avc from this morning.
Can you get the full output of ausearch -m avc
Created attachment 435324 [details] ausearch -m avc
Miroslav, Add allow logwatch_mail_t self:capability { dac_read_search dac_override }; to logwatch.te For reading all log files. Change mta.te exim calls to optional_policy(` exim_domtrans(user_mail_domain) exim_manage_log(user_mail_domain) ')
Fixed in selinux-policy-3.7.19-42.fc13
Am getting this in F14 Branched now Current installed policy: Source RPM Packages exim-4.71-4.fc14 Policy RPM selinux-policy-3.8.8-8.fc14
Fixed in selinux-policy-3.8.8-9.fc14
selinux-policy-3.8.8-20.fc14 has been submitted as an update for Fedora 14. http://admin.fedoraproject.org/updates/selinux-policy-3.8.8-20.fc14
selinux-policy-3.8.8-20.fc14 has been pushed to the Fedora 14 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.8.8-20.fc14
selinux-policy-3.8.8-20.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.