Hide Forgot
Description of problem: I am not sure whether this is a bug or not. The test case for bug 442028 produces following AVCs: ---- time->Thu Aug 11 10:17:34 2011 type=SYSCALL msg=audit(1313072254.344:233414): arch=80000016 syscall=11 per=400000 success=no exit=-13 a0=3fffff7c5f3 a1=8001eb60 a2=8001ec80 a3=200002514c0 items=0 ppid=11957 pid=11958 auid=4294967295 uid=502 gid=503 euid=502 suid=502 fsuid=502 egid=503 sgid=503 fsgid=503 tty=(none) ses=4294967295 comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null) type=AVC msg=audit(1313072254.344:233414): avc: denied { execute } for pid=11958 comm="procmail" name="hostname" dev=dm-0 ino=1177374 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file ---- time->Thu Aug 11 10:17:34 2011 type=SYSCALL msg=audit(1313072254.344:233415): arch=80000016 syscall=106 per=400000 success=no exit=-13 a0=80103790 a1=3fffff76550 a2=3fffff76550 a3=200001d69b0 items=0 ppid=11957 pid=11958 auid=4294967295 uid=502 gid=503 euid=502 suid=502 fsuid=502 egid=503 sgid=503 fsgid=503 tty=(none) ses=4294967295 comm="sh" exe="/bin/bash" subj=system_u:system_r:procmail_t:s0 key=(null) type=AVC msg=audit(1313072254.344:233415): avc: denied { getattr } for pid=11958 comm="sh" path="/bin/hostname" dev=dm-0 ino=1177374 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file ---- time->Thu Aug 11 10:17:36 2011 type=SYSCALL msg=audit(1313072256.164:233422): arch=80000016 syscall=11 per=400000 success=no exit=-13 a0=8001d2fa a1=8001eb60 a2=8001ec80 a3=200002514c0 items=0 ppid=11993 pid=11994 auid=4294967295 uid=501 gid=502 euid=501 suid=501 fsuid=501 egid=502 sgid=502 fsgid=502 tty=(none) ses=4294967295 comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null) type=AVC msg=audit(1313072256.164:233422): avc: denied { execute } for pid=11994 comm="procmail" name="hostname" dev=dm-0 ino=1177374 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file ---- time->Thu Aug 11 10:17:36 2011 type=SYSCALL msg=audit(1313072256.164:233423): arch=80000016 syscall=5 per=400000 success=no exit=-13 a0=801036f0 a1=0 a2=3fffff95e46 a3=0 items=0 ppid=11993 pid=11994 auid=4294967295 uid=501 gid=502 euid=501 suid=501 fsuid=501 egid=502 sgid=502 fsgid=502 tty=(none) ses=4294967295 comm="sh" exe="/bin/bash" subj=system_u:system_r:procmail_t:s0 key=(null) type=AVC msg=audit(1313072256.164:233423): avc: denied { read } for pid=11994 comm="sh" name="hostname" dev=dm-0 ino=1177374 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file This is because of procmail recipe which instructs procmail to execute hostname command: # cat /home/she10779/.procmailrc PATH=$HOME/bin:/bin:/usr/bin:/usr/local/bin MAILDIR=$HOME/mail LOGFILE=$HOME/mail/procmail.log HOST_NAME=`hostname` :0: * ^From:.*he6691@.*$ my-love I know that this can be avoided using $HOSTNAME instead of `hostname`. Strange thing is that this happend on s390x platform only, the test passed on other platforms. I am not sure whether there is any risk in allowing procmail to execute hostname command. Version-Release number of selected component (if applicable): selinux-policy-3.7.19-93.el6_1.7 How reproducible: always Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
Oh, now I can see the test should load a custom module to allow it. Switching to RHEL Tests component, the test should be reviewed.
Miroslav lets add application_exec_all(procmail_t)
OK, this is a policy bug, switching back to RHEL6 to QE: RHTS test should be updated to not to load the module.
Fixed in selinux-policy-3.7.19-108.el6
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1511.html