Bug 738994 - cyrus-imapd downgrade selinux test fail
Summary: cyrus-imapd downgrade selinux test fail
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.2
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks: 738995
TreeView+ depends on / blocked
 
Reported: 2011-09-16 09:41 UTC by Juraj Marko
Modified: 2018-02-09 10:18 UTC (History)
5 users (show)

Fixed In Version: selinux-policy-3.7.19-113.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 738995 (view as bug list)
Environment:
Last Closed: 2011-12-06 10:18:59 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:1511 0 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2011-12-06 00:39:17 UTC

Description Juraj Marko 2011-09-16 09:41:32 UTC 
Description of problem:
Running: /sbin/ausearch -sv no -m AVC -ts 09/15/2011 15:41:32 SELinux Check: FAIL SELinux AVC messages found: type=1400 audit(1316115719.288:35518): avc: denied { name_bind } for pid=31435 comm="cyrus-master" src=119 scontext=unconfined_u:system_r:cyrus_t:s0 tcontext=system_u:object_r:innd_port_t:s0 tclass=tcp_socket

Version-Release number of selected component (if applicable):
Name        : selinux-policy
Arch        : noarch
Version     : 3.7.19
Release     : 93.el6_1.7

How reproducible:
50%

Steps to Reproduce:
1. tps-rhnqa on cyrus-imapd
  
Actual results:
AVC messages found

Expected results:
no AVC messages found

Additional info:
Same on rhel5
Comment 1 Daniel Walsh 2011-09-16 15:29:22 UTC 
Why is cyrus-master trying to bind to port 119?  Is this something local to the test?
Comment 2 Juraj Marko 2011-09-20 04:47:23 UTC 
I think it is testing fot the port 119, if is it free or not, because cyrus-imapd is using it for NNTP. But I'm not sure. I can ask devel.
Comment 4 Daniel Walsh 2011-09-20 15:39:16 UTC 
Well if cyrus-master can run as an nntp server then we should probably just allow this access.
Comment 5 Daniel Walsh 2011-09-20 15:41:41 UTC 
Miroslav add

corenet_tcp_bind_innd_port(cyrus_t)
Comment 8 Miroslav Grepl 2011-09-25 10:30:33 UTC 
It was added to selinux-policy-3.7.19-113.el6.
Comment 12 errata-xmlrpc 2011-12-06 10:18:59 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1511.html
Note You need to log in before you can comment on or make changes to this bug.