Created attachment 520190 [details]
patch and spec file diff for selinux-policy-3.7.19-55.el6 SRPM

Description of problem:
selinux-policy preventing qmail-inject / qmail-queue / sendmail from search and write to /var/qmail/queue/, among other issues.  I noticed the problems because crond generated e-mail was not getting delivered, with an error message like:

 CROND[21591]: (root) MAIL (mailed 1290 bytes of output but got status 0x006f#012)

AVC errors in audit.log:

type=AVC msg=audit(1314228902.078:112210): avc:  denied  { search } for  pid=12894 comm="qmail-queue" name="queue" dev=dm-4 ino=655368 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:qmail_spool_t:s0 tclass=dir
type=AVC msg=audit(1314229501.848:112243): avc:  denied  { search } for  pid=13193 comm="qmail-queue" name="pid" dev=dm-4 ino=655470 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:qmail_spool_t:s0 tclass=dir
type=AVC msg=audit(1314239102.056:112926): avc:  denied  { write } for  pid=946 comm="qmail-queue" name="pid" dev=dm-4 ino=655470 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=dir
type=AVC msg=audit(1314245701.871:113246): avc:  denied  { write } for  pid=21283 comm="qmail-queue" name="trigger" dev=dm-4 ino=655365 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:qmail_spool_t:s0 tclass=fifo_file
type=AVC msg=audit(1314246901.535:113302): avc:  denied  { read } for  pid=21514 comm="qmail-queue" name="owners" dev=dm-4 ino=655362 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_t:s0 tclass=lnk_file


Version-Release number of selected component (if applicable): 3.7.19-54.el6


How reproducible: Always


Steps to Reproduce:
1. write a cron script which sends text to stderr
2. watch /var/log/cron and note the error sending the mail

Can also be reproduced by directly calling sendmail on a server with qmail as the MTA.


Actual results:
Using the first steps to reproduce, you'll see an error similar to this in /var/log/cron:

 CROND[21591]: (root) MAIL (mailed 1290 bytes of output but got status 0x006f#012)


Expected results:
Cron mail should get delivered by qmail, as well as any mail invoked via qmail's replacement sendmail command.



Additional info:
Attached is a patch to the selinux-policy SRPM, including spec file diff.  Basically, it does the following:

 1. change file context of /var/qmail/owners(/.*)? to qmail_etc_t
 2. allow processes of scontext system_mail_t read, write, search access to files, dirs, and fifos of tcontext qmail_spool_t

Let me know if this policy change poses any security issues or could be implemented a different way, as I'm rather new to SElinux policy.

Also note, this bug may also exist in RHEL 5, as Dan Walsh requested that I submit it under RHEL5 on the fedora-selinux mailing list.  I'm only submitting under RHEL6 since that's where I observed it.