Red Hat Bugzilla – Bug 890646
SELinux don't allow postfix to connect MySQL database
Last modified: 2014-11-07 05:50:06 EST
Description of problem: SELinux don't allow postfix to connect to MySQL database if Postfix use external storage for maps Version-Release number of selected component (if applicable): selinux-policy.noarch 3.7.19-189.el6 @selinux selinux-policy-targeted.noarch 3.7.19-189.el6 @selinux How reproducible: Set postfix maps as for example: virtual_mailbox_domains=mysql:/etc/postfix/domains virtual_mailbox_maps=mysql:/etc/postfix/mailboxes Steps to Reproduce: 1. Set Postfix maps as above 2. Send mail to this server Actual results: allow postfix_virtual_t mysqld_db_t:dir search; allow postfix_virtual_t mysqld_t:unix_stream_socket connectto; allow postfix_virtual_t mysqld_var_run_t:sock_file write; Expected results: No entries in audit.log Additional info: I suggest to solve this by adding tunable to postfix with mysql_stream_connect(postfix_virtual_t) and so for postgres
Lets back port d3b3143f959f738e805c855b155775478955391d
To backport commit from Comment 2, you would also need to backport postfix_domain attribute, which is missing on RHEL6. + optional_policy(` + mysql_stream_connect(postfix_domain) +') This bug was fixed just this way: + mysql_stream_connect(postfix_virtual_t) was there a reason not to backport suggested rule for whole postfix_domain?
It was not back ported.
Basically we don't have postfix_domain attribute in RHEL6.5. Should be also back ported.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-1598.html