Bug 853721 - selinux prevents spamass-milter from starting when using postfix
selinux prevents spamass-milter from starting when using postfix
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
17
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-09-02 08:02 EDT by Sjoerd Mullender
Modified: 2012-09-21 19:59 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-09-21 19:59:56 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Sjoerd Mullender 2012-09-02 08:02:16 EDT
Description of problem:
The spamass-milter configuration for postfix in spamass-milter-postfix tries to set the group for the socket file to "postfix" using a -g option in the file /etc/sysconfig/spamass-milter-postfix.  SELinux prevents spamass-milter from starting because it doesn't have access to the /etc/group file, so it can't translate the group name to group id.

Version-Release number of selected component (if applicable):
spamass-milter-postfix-0.3.2-6.fc17.noarch
selinux-policy-targeted-3.10.0-146.fc17.noarch

How reproducible:
100%

Steps to Reproduce:
1.install and configure postfix, spamass-milter-postfix
2.systemctl start spamass-milter
3.
  
Actual results:
spamass-milter fails to start (see /var/log/messages and systemctl status spamass-milter).

Expected results:
spamass-milter up and running

Additional info:
I was forced to turn off selinux because I had to get email working.

Relevant log messages:
audit log:
type=SERVICE_START msg=audit(1346581209.612:25102): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="spamass-milter" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=AVC msg=audit(1346581209.635:25103): avc:  denied  { read } for  pid=14930 comm="spamass-milter" name="group" dev="sda2" ino=61104 scontext=system_u:system_r:spamass_milter_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
type=SYSCALL msg=audit(1346581209.635:25103): arch=c000003e syscall=2 success=no exit=-13 a0=7fbad80b16bf a1=80000 a2=1b6 a3=238 items=0 ppid=1 pid=14930 auid=4294967295 uid=991 gid=987 euid=991 suid=991 fsuid=991 egid=987 sgid=987 fsgid=987 tty=(none) ses=4294967295 comm="spamass-milter" exe="/usr/sbin/spamass-milter" subj=system_u:system_r:spamass_milter_t:s0 key=(null)
type=SERVICE_STOP msg=audit(1346581209.663:25104): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="spamass-milter" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'

messages log:
Sep  2 12:20:09 taling spamass-milter[14930]: group option, getgrnam: Permission denied
Sep  2 12:20:09 taling systemd[1]: spamass-milter.service: main process exited, code=exited, status=67
Sep  2 12:20:09 taling systemd[1]: Unit spamass-milter.service entered failed state.
Sep  2 12:20:10 taling setroubleshoot: SELinux is preventing /usr/sbin/spamass-milter from read access on the file /etc/group. For complete SELinux messages. run sealert -l c19a2da6-a410-43ca-8bf1-a30c7274dd06
Comment 1 Paul Howarth 2012-09-03 04:36:57 EDT
milter.te needs this to support operation with postfix:

# Look up group name (needed by spamass-milter-postfix) (#853721)
auth_use_nsswitch(spamass_milter_t)

I've tested this locally and the daemon starts successfully with this addition to policy.
Comment 2 Miroslav Grepl 2012-09-03 13:19:21 EDT
Thank you. Added.
Comment 3 Fedora Update System 2012-09-17 08:14:17 EDT
selinux-policy-3.10.0-149.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-149.fc17
Comment 4 Fedora Update System 2012-09-18 22:55:52 EDT
Package selinux-policy-3.10.0-149.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-149.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-14301/selinux-policy-3.10.0-149.fc17
then log in and leave karma (feedback).
Comment 5 Fedora Update System 2012-09-21 19:59:56 EDT
selinux-policy-3.10.0-149.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.