Hide Forgot
Description of problem: When running Postfix + Amavis + Spamassassin on RHEL6, restorecon reports these mislabeled files: # restorecon -R -v -n /usr/bin restorecon reset /usr/bin/razor-admin context system_u:object_r:spamc_exec_t:s0->system_u:object_r:razor_exec_t:s0 restorecon reset /usr/bin/razor-revoke context system_u:object_r:spamc_exec_t:s0->system_u:object_r:razor_exec_t:s0 restorecon reset /usr/bin/razor-client context system_u:object_r:spamc_exec_t:s0->system_u:object_r:razor_exec_t:s0 restorecon reset /usr/bin/razor-report context system_u:object_r:spamc_exec_t:s0->system_u:object_r:razor_exec_t:s0 restorecon reset /usr/bin/razor-check context system_u:object_r:spamc_exec_t:s0->system_u:object_r:razor_exec_t:s0 However, if I tell restorecon to relabel these files (i.e. remove the -n flag from the previous command), the files are immediately relabeled from razor_exec_t to spamc_exec_t. It appears that either Amavis or Spamassassin is enforcing the labeling. Version-Release number of selected component (if applicable): # rpm -q selinux-policy selinux-policy-3.7.19-126.el6_2.3.noarch How reproducible: Every time. Steps to Reproduce: 1. Install/Configure amavisd-new (From EPEL) and install/configure Spamassassin 2. Start amavisd and spamd 3. Check labeling on the files in /usr/bin, try to fix the labels. Additional Information: I'm not sure if the correct fix is to change the selinux policy or to fix the applications. It should also be noted that this mislabeling doesn't appear to be breaking anything. Our monitoring system is just watching for mislabeled files and alerted us to this issue.
This is happening because spamc_exec_t and razor_exec_t are alias files. In order to fix this we really need to eliminate the razor.pp file altogether and just ship the file context in spamassassin.pp like we have in F17.
Yes.
Fixed in selinux-policy-3.7.19-149.el6
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0780.html