Bug 733869 - selinux policy for qmail service prevents qmail-inject/sendmail
Summary: selinux policy for qmail service prevents qmail-inject/sendmail
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.3
Hardware: All
OS: Linux
medium
high
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks: 734116
TreeView+ depends on / blocked
 
Reported: 2011-08-27 23:55 UTC by adi
Modified: 2012-10-16 11:43 UTC (History)
2 users (show)

Fixed In Version: selinux-policy-3.7.19-109.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 734116 (view as bug list)
Environment:
Last Closed: 2011-12-06 10:15:36 UTC


Attachments (Terms of Use)
patch and spec file diff for selinux-policy-3.7.19-55.el6 SRPM (1.31 KB, application/x-tar)
2011-08-27 23:55 UTC, adi
no flags Details


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:1511 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2011-12-06 00:39:17 UTC

Description adi 2011-08-27 23:55:10 UTC
Created attachment 520190 [details]
patch and spec file diff for selinux-policy-3.7.19-55.el6 SRPM

Description of problem:
selinux-policy preventing qmail-inject / qmail-queue / sendmail from search and write to /var/qmail/queue/, among other issues.  I noticed the problems because crond generated e-mail was not getting delivered, with an error message like:

 CROND[21591]: (root) MAIL (mailed 1290 bytes of output but got status 0x006f#012)

AVC errors in audit.log:

type=AVC msg=audit(1314228902.078:112210): avc:  denied  { search } for  pid=12894 comm="qmail-queue" name="queue" dev=dm-4 ino=655368 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:qmail_spool_t:s0 tclass=dir
type=AVC msg=audit(1314229501.848:112243): avc:  denied  { search } for  pid=13193 comm="qmail-queue" name="pid" dev=dm-4 ino=655470 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:qmail_spool_t:s0 tclass=dir
type=AVC msg=audit(1314239102.056:112926): avc:  denied  { write } for  pid=946 comm="qmail-queue" name="pid" dev=dm-4 ino=655470 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=dir
type=AVC msg=audit(1314245701.871:113246): avc:  denied  { write } for  pid=21283 comm="qmail-queue" name="trigger" dev=dm-4 ino=655365 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:qmail_spool_t:s0 tclass=fifo_file
type=AVC msg=audit(1314246901.535:113302): avc:  denied  { read } for  pid=21514 comm="qmail-queue" name="owners" dev=dm-4 ino=655362 scontext=unconfined_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_t:s0 tclass=lnk_file


Version-Release number of selected component (if applicable): 3.7.19-54.el6


How reproducible: Always


Steps to Reproduce:
1. write a cron script which sends text to stderr
2. watch /var/log/cron and note the error sending the mail

Can also be reproduced by directly calling sendmail on a server with qmail as the MTA.


Actual results:
Using the first steps to reproduce, you'll see an error similar to this in /var/log/cron:

 CROND[21591]: (root) MAIL (mailed 1290 bytes of output but got status 0x006f#012)


Expected results:
Cron mail should get delivered by qmail, as well as any mail invoked via qmail's replacement sendmail command.



Additional info:
Attached is a patch to the selinux-policy SRPM, including spec file diff.  Basically, it does the following:

 1. change file context of /var/qmail/owners(/.*)? to qmail_etc_t
 2. allow processes of scontext system_mail_t read, write, search access to files, dirs, and fifos of tcontext qmail_spool_t

Let me know if this policy change poses any security issues or could be implemented a different way, as I'm rather new to SElinux policy.

Also note, this bug may also exist in RHEL 5, as Dan Walsh requested that I submit it under RHEL5 on the fedora-selinux mailing list.  I'm only submitting under RHEL6 since that's where I observed it.

Comment 2 Miroslav Grepl 2011-08-29 07:54:59 UTC
Thanks for the patch. I am adding it.

Comment 3 Miroslav Grepl 2011-08-31 19:55:36 UTC
Fixed in selinux-policy-3.7.19-109.el6

Comment 6 adi 2011-10-13 03:45:04 UTC
Responding to Milos Malik's needinfo:

Sorry, I found this bug in CentOS, not RHEL6, and the latest selinux-policy package Miroslav applied the patch in has not yet been pushed out to CentOS 6.

Not sure if this is an issue with CentOS or RHEL 6.  I'll go try to find the latest selinux-policy RPM so I can verify it's fixed.

Comment 7 adi 2011-10-14 16:21:50 UTC
Okay, I don't know how to get the selinux-policy-3.7.19-109.el6 package in order to test it.

It makes sense that it's not released yet, and pushed out to RHEL6 / CentOS6 -- since it hasn't passed QA yet.

But where do I download the package in order to test it?

Comment 8 Milos Malik 2011-10-17 06:59:23 UTC
Here is latest policy: http://people.redhat.com/dwalsh/SELinux/RHEL6/noarch/

Comment 11 adi 2011-10-17 17:45:13 UTC
(In reply to comment #8)
> Here is latest policy: http://people.redhat.com/dwalsh/SELinux/RHEL6/noarch/

Thanks.

Okay, I installed selinux-policy-{,targeted-}3.7.19-117.el6.noarch, and triggered the test case of crond generated mail, and the mail was delivered.  I also tested by qmail-inject directly via command line, and that also worked.  No AVC errors in audit.log.

So it passes QA from my perspective.

Comment 13 errata-xmlrpc 2011-12-06 10:15:36 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1511.html


Note You need to log in before you can comment on or make changes to this bug.