Bug 842968 - dovecot can't access ~/Maildir
Summary: dovecot can't access ~/Maildir
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.3
Hardware: All
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Michal Trunecka
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-07-25 07:03 UTC by Ferry Huberts
Modified: 2014-09-30 23:33 UTC (History)
4 users (show)

Fixed In Version: selinux-policy-3.7.19-156.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-02-21 08:26:08 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2013:0314 0 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2013-02-20 20:35:01 UTC

Description Ferry Huberts 2012-07-25 07:03:05 UTC
Description of problem:
dovecot can't access ~/Maildir

Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-155.el6_3.noarch
dovecot-2.0.9-2.el6_1.1.x86_64

How reproducible:
always

Steps to Reproduce:
1.
2.
3.
  
Actual results:
type=AVC msg=audit(1343199481.479:54157): avc:  denied  { read } for  pid=25571 comm="imap" name="Maildir" dev=dm-2 ino=9175805 scontext=unconfined_u:system_r:dovecot_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir
type=SYSCALL msg=audit(1343199481.479:54157): arch=c000003e syscall=21 success=no exit=-13 a0=704250 a1=4 a2=6daac0 a3=fffffffb items=0 ppid=25550 pid=25571 auid=0 uid=503 gid=503 euid=503 suid=503 fsuid=503 egid=503 sgid=503 fsgid=503 tty=(none) ses=3543 comm="imap" exe="/usr/libexec/dovecot/imap" subj=unconfined_u:system_r:dovecot_t:s0 key=(null)


Expected results:


Additional info:

Comment 1 Miroslav Grepl 2012-07-25 11:46:31 UTC
The latest RHEL6.4 build has

mta_manage_home_rw(dovecot_t)

Comment 2 Ferry Huberts 2012-07-25 14:22:07 UTC
I'd like this as a high prio fix on 6.3 as well. currently I have to disable enforcing the policy...

Comment 3 Daniel Walsh 2012-08-02 20:42:02 UTC
You can test the latest rhel6.4 policy by grabbing it from

http://people.redhat.com/dwalsh/SELinux/RHEL6

Comment 5 Ferry Huberts 2012-11-05 10:44:07 UTC
sorry for the late reply.

Can't do that Dan, this occurs on (at least) 3 production machines and I'm not willing to put an in-testing policy on a production machine

Comment 6 Daniel Walsh 2012-11-05 18:41:51 UTC
Well you can install a policy module to allow the access if you want

# cat mydovecot.te
policy_module(mydovecot, 1.0)
gen_require(`
 type dovecot_t;
')
mta_manage_home_rw(dovecot_t)
# make -f /usr/share/selinux/devel/Makefile
# semodule -i mydovecot.pp

Should fix the AVC.

Comment 8 errata-xmlrpc 2013-02-21 08:26:08 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0314.html


Note You need to log in before you can comment on or make changes to this bug.