Description of problem: Version-Release number of selected component (if applicable): selinux-policy-targeted-2.4.6-328.el5 selinux-policy-2.4.6-328.el5 selinux-policy-devel-2.4.6-328.el5 amavisd-new-2.4.5-1.el5 How reproducible: always Steps to Reproduce: # grep -v -e '^#' -e '^$' /etc/clamd.d/amavisd.conf LogSyslog 1 LogFacility LOG_MAIL PidFile /var/run/amavisd/clamd.pid FixStaleSocket 1 User amavis LocalSocket /var/spool/amavisd/clamd.sock # service clamd.amavisd restart Stopping clamd.amavisd: [FAILED] Starting clamd.amavisd: LibClamAV Warning: ************************************************** LibClamAV Warning: *** The virus database is older than 7 days! *** LibClamAV Warning: *** Please update it as soon as possible. *** LibClamAV Warning: ************************************************** [ OK ] # ausearch -m avc -ts recent Actual results: ---- time->Mon Jul 9 06:02:01 2012 type=SYSCALL msg=audit(1341828121.581:35250): arch=40000003 syscall=10 success=no exit=-13 a0=90d8268 a1=90d6448 a2=90d6408 a3=1 items=0 ppid=1 pid=32167 auid=0 uid=102 gid=159 euid=102 suid=102 fsuid=102 egid=159 sgid=159 fsgid=159 tty=(none) ses=3452 comm="clamd" exe="/usr/sbin/clamd" subj=root:system_r:clamd_t:s0 key=(null) type=AVC msg=audit(1341828121.581:35250): avc: denied { search } for pid=32167 comm="clamd" name="amavisd" dev=dm-0 ino=3506181 scontext=root:system_r:clamd_t:s0 tcontext=system_u:object_r:amavis_var_run_t:s0 tclass=dir ---- time->Mon Jul 9 06:02:13 2012 type=SYSCALL msg=audit(1341828133.748:35251): arch=40000003 syscall=5 success=no exit=-13 a0=8d31268 a1=241 a2=1b6 a3=8d32bc8 items=0 ppid=32248 pid=32249 auid=0 uid=102 gid=159 euid=102 suid=102 fsuid=102 egid=159 sgid=159 fsgid=159 tty=(none) ses=3452 comm="clamd" exe="/usr/sbin/clamd" subj=root:system_r:clamd_t:s0 key=(null) type=AVC msg=audit(1341828133.748:35251): avc: denied { search } for pid=32249 comm="clamd" name="amavisd" dev=dm-0 ino=3506181 scontext=root:system_r:clamd_t:s0 tcontext=system_u:object_r:amavis_var_run_t:s0 tclass=dir ---- Expected results: * no AVCs
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux release for currently deployed products. This request is not yet committed for inclusion in a release.
And what are you getting in permissive mode?
---- time->Tue Jul 10 04:45:13 2012 type=SYSCALL msg=audit(1341909913.962:41877): arch=40000003 syscall=5 success=yes exit=5 a0=9dac268 a1=241 a2=1b6 a3=9de31e0 items=0 ppid=20907 pid=20908 auid=0 uid=102 gid=159 euid=102 suid=102 fsuid=102 egid=159 sgid=159 fsgid=159 tty=(none) ses=4225 comm="clamd" exe="/usr/sbin/clamd" subj=root:system_r:clamd_t:s0 key=(null) type=AVC msg=audit(1341909913.962:41877): avc: denied { add_name } for pid=20908 comm="clamd" name="clamd.pid" scontext=root:system_r:clamd_t:s0 tcontext=system_u:object_r:amavis_var_run_t:s0 tclass=dir type=AVC msg=audit(1341909913.962:41877): avc: denied { write } for pid=20908 comm="clamd" name="amavisd" dev=dm-0 ino=3506181 scontext=root:system_r:clamd_t:s0 tcontext=system_u:object_r:amavis_var_run_t:s0 tclass=dir type=AVC msg=audit(1341909913.962:41877): avc: denied { search } for pid=20908 comm="clamd" name="amavisd" dev=dm-0 ino=3506181 scontext=root:system_r:clamd_t:s0 tcontext=system_u:object_r:amavis_var_run_t:s0 tclass=dir ---- time->Tue Jul 10 04:46:12 2012 type=SYSCALL msg=audit(1341909972.259:41878): arch=40000003 syscall=10 success=yes exit=0 a0=9dac268 a1=9daa448 a2=9daa408 a3=1 items=0 ppid=1 pid=20908 auid=0 uid=102 gid=159 euid=102 suid=102 fsuid=102 egid=159 sgid=159 fsgid=159 tty=(none) ses=4225 comm="clamd" exe="/usr/sbin/clamd" subj=root:system_r:clamd_t:s0 key=(null) type=AVC msg=audit(1341909972.259:41878): avc: denied { remove_name } for pid=20908 comm="clamd" name="clamd.pid" dev=dm-0 ino=3506292 scontext=root:system_r:clamd_t:s0 tcontext=system_u:object_r:amavis_var_run_t:s0 tclass=dir ----
Ok, we need to fix amavis_create_pid_files() interface. I am adding fixes to Fedora.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-0060.html