When Asterisk is configured to use plain files for voicemail, and to send the voicemail via an email attachment, the mailsystem (Postfix in my case) needs to be able to access the spooled file created by Asterisk. I receive the following errors when someone leaves me a voicemail with selinux-policy-targeted-3.9.16-30.fc15.noarch. type=AVC msg=audit(1309785488.610:21012): avc: denied { read } for pid=7402 comm="sendmail" path="/tmp/astmail-EqS8ei" dev=sda2 ino=6604 scontext=system_u:system_r:system_mail_t:s0 tcontext=system_u:object_r:asterisk_tmp_t:s0 tclass=file type=SYSCALL msg=audit(1309785488.610:21012): arch=i386 syscall=execve success=yes exit=0 a0=8cf6718 a1=8cf6878 a2=8cf59c8 a3=8cf6878 items=0 ppid=7401 pid=7402 auid=4294967295 uid=496 gid=484 euid=496 suid=496 fsuid=496 egid=484 sgid=484 fsgid=484 tty=(none) ses=4294967295 comm=sendmail exe=/usr/sbin/sendmail.postfix subj=system_u:system_r:system_mail_t:s0 key=(null) Hash: sendmail,system_mail_t,asterisk_tmp_t,file,read audit2allow #============= system_mail_t ============== allow system_mail_t asterisk_tmp_t:file read; audit2allow -R #============= system_mail_t ============== allow system_mail_t asterisk_tmp_t:file read;
Fixed in selinux-policy-3.9.16-33.fc15
I confirm the fix with the following from Koji: selinux-policy-3.9.16-33.fc15.noarch.rpm selinux-policy-targeted-3.9.16-33.fc15.noarch.rpm Thank you.
selinux-policy-3.9.16-35.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/selinux-policy-3.9.16-35.fc15
Package selinux-policy-3.9.16-35.fc15: * should fix your issue, * was pushed to the Fedora 15 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.9.16-35.fc15' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/selinux-policy-3.9.16-35.fc15 then log in and leave karma (feedback).
selinux-policy-3.9.16-35.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report.