Bug 704262 - AVC set to not audit prevent easy policy modifications for roundcube mail and postfix
Summary: AVC set to not audit prevent easy policy modifications for roundcube mail and...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 14
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-05-12 15:46 UTC by Andrew Duggan
Modified: 2011-10-30 00:33 UTC (History)
1 user (show)

Fixed In Version: selinux-policy-3.9.7-46.fc14
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-10-30 00:33:26 UTC
Type: ---


Attachments (Terms of Use)

Description Andrew Duggan 2011-05-12 15:46:58 UTC
Description of problem:
SELinux is preventing roundcubemail/apache/httpd from sending via postfix (both are on the same server)  cat /var/log/audit/audit.log | audit2allow -m roundcubemail > roundcubemail.te with the necessary checkmodule semodule_package and semodule -i to modify the policy don't end up with a policy that allows that, so the avc must not be audited.

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.9.7-40.fc14.noarch

How reproducible:
all the time

Steps to Reproduce:
1.setenforce 0 then send from roundcubemail 
2.cat /var/log/audit/audit.log | audit2allow -m roundcubemail > roundcubemail.te
3.checkmodule -M -m -o roundcubemail.mod roundcubemail.te
4.semodule_package -o roundcubemail.pp -m roundcubemail.mod
5.semodule -i roundcubemail.pp
6.setenforce 1
7.send from roundcube  
  
Actual results:
roundcube can't send the email, with setenforce 1, can with setenforce 0

Expected results:
rouncubue should able to send with setenforce 1 after adding the above process


Additional info:

Comment 1 Andrew Duggan 2011-05-19 16:01:07 UTC
I finally found it after doing a semodule -DB but as an enhancement a flag for sebool for turning off dontaudits would be better.

Comment 2 Daniel Walsh 2011-05-23 15:27:10 UTC
What was the AVC that was being blocked?

Comment 3 Andrew Duggan 2011-05-23 17:55:54 UTC
Hi,
These are the two AVCs

type=AVC msg=audit(1305818917.735:36670): avc:  denied  { execute } for  pid=23766 comm="sendmail" name="postdrop" dev
=dm-0 ino=134464 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:postfix_postdrop_exec_t:s0 tclas
s=file
type=AVC msg=audit(1305818917.735:36670): avc:  denied  { execute_no_trans } for  pid=23766 comm="sendmail" path="/usr/sbin/postdrop" dev=dm-0 ino=134464 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:postfix_postdrop_exec_t:s0 tclass=file

from which this was generated by audit2allow

allow httpd_t postfix_postdrop_exec_t:file { execute execute_no_trans read open };


# which sendmail
/usr/sbin/sendmail

# ls -laZ /usr/sbin/sendmail
lrwxrwxrwx. root root unconfined_u:object_r:bin_t:s0   /usr/sbin/sendmail -> /etc/alternatives/mta

I did a restorecon on /usr/sbin/sendmail, just to make sure it wasn't incorrectly labeled, but it that was the context both before and after the restorcon.

Comment 4 Daniel Walsh 2011-05-23 19:32:54 UTC
If you execute httpd_can_sendmail, would this be allowed.

# setsebool -P httpd_can_sendmail 1

Comment 5 Daniel Walsh 2011-05-23 19:34:53 UTC
sesearch --dontaudit -s httpd_t -t postfix_postdrop_exec_t
WARNING: Policy would be downgraded from version 26 to 25.
Found 1 semantic av rules:
   dontaudit httpd_t exec_type : file { execute execute_no_trans } ; 


This is probably a bad idea.

Maybe we should transition these to httpd_sys_script_t?  Or just eliminate the dontaudit.

Comment 6 Daniel Walsh 2011-05-23 19:43:47 UTC
Ok researching this further it looks like we are using a application_exec from apache which includes this interface.



Postfix.if

postfix_user_domain_template'
+       application_domain(postfix_$1_t, postfix_$1_exec_t)


Miroslav can you add this to F14, RHEL6.

Comment 7 Miroslav Grepl 2011-10-20 08:19:24 UTC
selinux-policy-3.9.7-46.fc14

Comment 8 Fedora Update System 2011-10-20 11:57:30 UTC
selinux-policy-3.9.7-46.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-46.fc14

Comment 9 Fedora Update System 2011-10-22 08:20:41 UTC
Package selinux-policy-3.9.7-46.fc14:
* should fix your issue,
* was pushed to the Fedora 14 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.9.7-46.fc14'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2011-14734
then log in and leave karma (feedback).

Comment 10 Fedora Update System 2011-10-30 00:33:26 UTC
selinux-policy-3.9.7-46.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.