Hide Forgot
Description of problem: New files in /var/mail/ are created with object_r:quota_db_t context instead of object_r:mail_spool_t. Mail to these users then gets bounced. $ useradd someuser $ ls -laZ /var/mail/ drwxrwxr-x. root mail system_u:object_r:mail_spool_t:s0 . drwxr-xr-x. root root system_u:object_r:var_spool_t:s0 .. -rw-------. root mail system_u:object_r:mail_spool_t:s0 root -rw-rw----. rpc mail system_u:object_r:mail_spool_t:s0 rpc -rw-rw----. someuser mail unconfined_u:object_r:quota_db_t:s0 someuser -rw-rw----. test mail system_u:object_r:mail_spool_t:s0 test restorecon fixes the issue: $ restorecon -Rv /var/mail/ restorecon reset /var/spool/mail/someuser context unconfined_u:object_r:quota_db_t:s0->unconfined_u:object_r:mail_spool_t:s0 $ ls -laZ /var/mail/ drwxrwxr-x. root mail system_u:object_r:mail_spool_t:s0 . drwxr-xr-x. root root system_u:object_r:var_spool_t:s0 .. -rw-r--r--. root root unconfined_u:object_r:mail_spool_t:s0 newfile -rw-------. root mail system_u:object_r:mail_spool_t:s0 root -rw-rw----. rpc mail system_u:object_r:mail_spool_t:s0 rpc -rw-rw----. someuser mail unconfined_u:object_r:mail_spool_t:s0 someuser -rw-rw----. test mail system_u:object_r:mail_spool_t:s0 test Version-Release number of selected component (if applicable): selinux-policy-3.10.0-56.el7.noarch
This is fixed in the latest selinux policy in F17 which is what I wish you were testing, rather then something that has been fixed in F16 for quite a while.