Red Hat Bugzilla – Bug 745380
SELinux seems to block sending e-mails from the squirrelmail web interface
Last modified: 2013-01-07 23:59:42 EST
Description of problem: SELinux seems to block sending e-mails from the squirrelmail web interface. Error message is (in squirrelmail): "75 Can't execute command '/usr/sbin/sendmail -i -t -fsender@example.com" Message goes if setenforce = 0. Version-Release number of selected component (if applicable): This was tested on CentOS 6.0 and squirrelmail from 6.0 EPEL (this bug was put here because squirrelmail seems to be excluded from 6.x). squirrelmail-1.4.22-2.el6.noarch selinux-policy-targeted-3.7.19-93.el6_1.7.noarch postfix-2.6.6-2.1.el6_0.x86_64 Actual results: SELinux blocks squirrelmail, with the above message. Expected results: The default SELinux policy should allow normal operation of squirrelmail in all Red Hat-based distros.
What AVC's are you seeing? I am not sure if squirrelmail needs the httpd_can_sendmail boolean turned on. setsebool -P httpd_can_sendmail 1
Hello, With SELinux enabled, ausearch gives me this: type=SYSCALL msg=audit(1318429512.012:45963): arch=c000003e syscall=80 success=no exit=-13 a0=7f9167a5b250 a1=7f9167a5c3b0 a2=2000 a3=7fffab330ec0 items=0 ppid=60132 pid=57437 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=41 comm="sendmail" exe="/usr/sbin/sendmail.postfix" subj=unconfined_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1318429512.012:45963): avc: denied { search } for pid=57437 comm="sendmail" name="postfix" dev=sda2 ino=10224303 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:postfix_spool_t:s0 tclass=dir and I also have sendmail: fatal: chdir /var/spool/postfix: Permission denied in /etc/httpd/logs/error_log Thanks a lot, Răzvan
Did you turn on the boolean?
Hello, I may confirm that setting the httpd_can_sendmail boolean to 1 apparently solved the problem: setsebool -P httpd_can_sendmail 1 IMHO, this SELinux setting should be automagically turned on by the squirrelmail package, when installing squirrelmail (OR default in selinux-policy-targeted). Could you please Cc the squirrelmail package maintainer ? Many thanks, Răzvan
I don't think that would be a good idea since people could install the squirrelmail package without every intending to use it (Everything install). But we probably should put it in the Readme/Documentation.
The distro is big these days, squirrelmail is not even part of the new 6.x series in RHEL and CentOS and there is no „Install Everyting” option in anaconda. People who want squrrelmail must specifically dig for it in EPEL. IMHO, the security vs. usability balance inclines to usability here, since the risk of installing squirrelmail when not really intending to is practically zero. Răzvan
With correct selinux boolean set, it should work, lowering severity. This bug will be documentation change only.
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux release for currently deployed products. This request is not yet committed for inclusion in a release.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0126.html