Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Summary:
SELinux is preventing /usr/libexec/postfix/pickup "module_request" access on <Unknown>.
Detailed Description:
SELinux denied access requested by pickup. The current boolean settings do not
allow this access. If you have not setup pickup to require this access this may
signal an intrusion attempt. If you do intend this access you need to change the
booleans on this system to allow the access.
Allowing Access:
Confined processes can be configured to run requiring different access, SELinux
provides booleans to allow you to turn on/off access as needed. The boolean
domain_kernel_load_modules is set incorrectly.
Boolean Description:
Allow all domains to have the kernel load modules
Fix Command:
# setsebool -P domain_kernel_load_modules 1
Additional Information:
Source Context system_u:system_r:postfix_pickup_t:s0
Target Context system_u:system_r:kernel_t:s0
Target Objects None [ system ]
Source pickup
Source Path /usr/libexec/postfix/pickup
Port <Unknown>
Host colder-el6
Source RPM Packages postfix-2.6.6-2.el6
Target RPM Packages
Policy RPM selinux-policy-3.7.19-54.el6_0.3
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Plugin Name catchall_boolean
Host Name colder-el6
Platform Linux colder-el6 2.6.32-71.14.1.el6.x86_64 #1 SMP
Wed Jan 5 17:01:01 EST 2011 x86_64 x86_64
Alert Count 9
First Seen Wed 02 Feb 2011 09:55:46 PM MSK
Last Seen Thu 03 Feb 2011 11:15:46 AM MSK
Local ID e56ddddd-cfbb-44d4-b8ca-3e7f999b7a66
Line Numbers
Raw Audit Messages
node=colder-el6 type=AVC msg=audit(1296720946.530:34611): avc: denied { module_request } for pid=26925 comm="pickup" kmod="net-pf-10" scontext=system_u:system_r:postfix_pickup_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system
node=colder-el6 type=SYSCALL msg=audit(1296720946.530:34611): arch=c000003e syscall=41 success=no exit=-97 a0=a a1=1 a2=0 a3=7fffb3493940 items=0 ppid=1949 pid=26925 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pickup" exe="/usr/libexec/postfix/pickup" subj=system_u:system_r:postfix_pickup_t:s0 key=(null)
There is no fix to this currently, There is a new version of setroubleshoot that ignores this error.
Could you look at
https://bugzilla.redhat.com/show_bug.cgi?id=641836
And see if this solution works for you.
Yes, this workaround works, however it would be much better to have this warning fixed specifically for ipv6 module, and not for all modules.
Anyway I did not realise this package has the same maintainer for RHEL and Fedora and wanted to inform you, seeing as this problem was already closed in Fedora. I will wait for setroubleshoot to be updated then.
I'm not sure what to do with this bug now. Should I mark it as duplicate?
Seeing this kind of errors for sshd, puppetmaster et al. after disabling IPV6 according to the following steps:
https://access.redhat.com/kb/docs/DOC-8711
Do I understand it correctly that the fix is on the way to RHEL6.2? Otherwise, would be nice to update this KB article.
Thanks!
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
http://rhn.redhat.com/errata/RHBA-2011-1509.html
Summary: SELinux is preventing /usr/libexec/postfix/pickup "module_request" access on <Unknown>. Detailed Description: SELinux denied access requested by pickup. The current boolean settings do not allow this access. If you have not setup pickup to require this access this may signal an intrusion attempt. If you do intend this access you need to change the booleans on this system to allow the access. Allowing Access: Confined processes can be configured to run requiring different access, SELinux provides booleans to allow you to turn on/off access as needed. The boolean domain_kernel_load_modules is set incorrectly. Boolean Description: Allow all domains to have the kernel load modules Fix Command: # setsebool -P domain_kernel_load_modules 1 Additional Information: Source Context system_u:system_r:postfix_pickup_t:s0 Target Context system_u:system_r:kernel_t:s0 Target Objects None [ system ] Source pickup Source Path /usr/libexec/postfix/pickup Port <Unknown> Host colder-el6 Source RPM Packages postfix-2.6.6-2.el6 Target RPM Packages Policy RPM selinux-policy-3.7.19-54.el6_0.3 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall_boolean Host Name colder-el6 Platform Linux colder-el6 2.6.32-71.14.1.el6.x86_64 #1 SMP Wed Jan 5 17:01:01 EST 2011 x86_64 x86_64 Alert Count 9 First Seen Wed 02 Feb 2011 09:55:46 PM MSK Last Seen Thu 03 Feb 2011 11:15:46 AM MSK Local ID e56ddddd-cfbb-44d4-b8ca-3e7f999b7a66 Line Numbers Raw Audit Messages node=colder-el6 type=AVC msg=audit(1296720946.530:34611): avc: denied { module_request } for pid=26925 comm="pickup" kmod="net-pf-10" scontext=system_u:system_r:postfix_pickup_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system node=colder-el6 type=SYSCALL msg=audit(1296720946.530:34611): arch=c000003e syscall=41 success=no exit=-97 a0=a a1=1 a2=0 a3=7fffb3493940 items=0 ppid=1949 pid=26925 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pickup" exe="/usr/libexec/postfix/pickup" subj=system_u:system_r:postfix_pickup_t:s0 key=(null)