Bug 886563

Following AVC appears in enforcing mode:
----
time->Wed Dec 12 18:44:54 2012
type=PATH msg=audit(1355334294.565:866): item=1 name=(null) inode=3407874 dev=08:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0
type=PATH msg=audit(1355334294.565:866): item=0 name="/usr/local/bin/postlogin.sh" inode=4212606 dev=08:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:bin_t:s0
type=CWD msg=audit(1355334294.565:866):  cwd="/var/run/dovecot"
type=EXECVE msg=audit(1355334294.565:866):
type=SYSCALL msg=audit(1355334294.565:866): arch=c000003e syscall=59 success=no exit=-13 a0=163639d a1=162ed38 a2=164b5d0 a3=7fff498d5a80 items=2 ppid=10225 pid=10283 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=63 comm="script-login" exe="/usr/libexec/dovecot/script-login" subj=unconfined_u:system_r:dovecot_t:s0 key=(null)
type=AVC msg=audit(1355334294.565:866): avc:  denied  { execute } for  pid=10283 comm="script-login" name="bash" dev=sda3 ino=3407874 scontext=unconfined_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
----

Following AVCs appear in permissive mode:
----
time->Wed Dec 12 18:46:27 2012
type=PATH msg=audit(1355334387.250:905): item=2 name=(null) inode=6032943 dev=08:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0
type=PATH msg=audit(1355334387.250:905): item=1 name=(null) inode=3407874 dev=08:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0
type=PATH msg=audit(1355334387.250:905): item=0 name="/usr/local/bin/postlogin.sh" inode=4212606 dev=08:03 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:bin_t:s0
type=CWD msg=audit(1355334387.250:905):  cwd="/var/run/dovecot"
type=EXECVE msg=audit(1355334387.250:905): argc=2 a0="/bin/sh" a1="/usr/local/bin/postlogin.sh"
type=EXECVE msg=audit(1355334387.250:905): argc=3 a0="/bin/sh" a1="/usr/local/bin/postlogin.sh" a2="/usr/libexec/dovecot/script-login"
type=SYSCALL msg=audit(1355334387.250:905): arch=c000003e syscall=59 success=yes exit=0 a0=22f939d a1=22f1d38 a2=230e5d0 a3=7fffb7114f00 items=3 ppid=10733 pid=10791 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=63 comm="postlogin.sh" exe="/bin/bash" subj=unconfined_u:system_r:dovecot_t:s0 key=(null)
type=AVC msg=audit(1355334387.250:905): avc:  denied  { read open } for  pid=10791 comm="script-login" name="bash" dev=sda3 ino=3407874 scontext=unconfined_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
type=AVC msg=audit(1355334387.250:905): avc:  denied  { execute } for  pid=10791 comm="script-login" name="bash" dev=sda3 ino=3407874 scontext=unconfined_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
----

I added it to Fedora. Will backport.

Hello there,

I have exactly the same problem running RHEL 6.3.  I managed to solve it creating custom policies.

First of all, we have to create a policy that allows dovecot to execute shell scripts:

module dovecot-scriptlogin-bash-mypol 1.0;

require {
	type dovecot_t;
	type shell_exec_t;
	class file { read execute open };
}

#============= dovecot_t ==============
allow dovecot_t shell_exec_t:file { read execute open };



And then we need another policy to allow dovecot execute the /usr/bin/mysql client from inside the shell script and connect to MySQL.  Oddly enough, it required some special permissions to execute getattr, read and open syscall over the file /usr/share/mysql/charsets/Index.xml:

module dovecot-scriptlogin-mysql-mypol 1.0;

require {
	type mysqld_db_t;
	type dovecot_t;
	type mysqld_var_run_t;
	type usr_t;
	type mysqld_t;
	class sock_file write;
	class unix_stream_socket connectto;
	class file { read getattr open };
	class dir search;
}

#============= dovecot_t ==============
allow dovecot_t mysqld_db_t:dir search;
allow dovecot_t mysqld_t:unix_stream_socket connectto;
allow dovecot_t mysqld_var_run_t:sock_file write;
allow dovecot_t usr_t:file { read getattr open };



I'll attach in another comment the audit logs required to create this policies.

Created attachment 675946 [details]
audit logs when dovecot tries to execute shell scripts

To load this I used the following commands:

$ cat dovecot-scriptlogin-bash-audit.log | audit2allow -M dovecot-scriptlogin-bash-mypol
$ sudo semodule -i dovecot-scriptlogin-bash-mypol.pp

Created attachment 675948 [details]
audit logs when dovecot tries to connect to MySQL from the shell script

To load this policy I used the following commands:

$ cat dovecot-scriptlogin-mysql-audit.log | audit2allow -M dovecot-scriptlogin-mysql-mypol
$ sudo semodule -i dovecot-scriptlogin-mysql-mypol.pp

This log is the one that show the access attempts to /usr/share/mysql/charsets/Index.xml

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0314.html