dovecot denials

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/24/2012 09:44 AM, Vadym Chepkov wrote:
> 
> On Jul 24, 2012, at 9:37 AM, Daniel J Walsh wrote:
> 
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>> 
>> On 07/24/2012 06:54 AM, Vadym Chepkov wrote:
>>> Hi,
>>> 
>>> man dovecot_selinux doesn't show any booleans and yet I get the
>>> following AVC, which in my opinion should be allowed:
>>> 
>>> ---- time->Mon Jul 23 00:10:03 2012 type=SYSCALL 
>>> msg=audit(1343002203.689:153237): arch=40000003 syscall=33 success=yes 
>>> exit=0 a0=8a472c0 a1=2 a2=bb2d84 a3=8a73418 items=0 ppid=1265
>>> pid=22329 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505
>>> egid=505 sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap" 
>>> exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0 
>>> key=(null) type=AVC msg=audit(1343002203.689:153237): avc:  denied  {
>>> write } for  pid=22329 comm="imap" name="cur" dev=xvdb1 ino=1045676 
>>> scontext=system_u:system_r:dovecot_t:s0 
>>> tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir ----
>>> time->Mon Jul 23 00:10:03 2012 type=SYSCALL
>>> msg=audit(1343002203.689:153238): arch=40000003 syscall=5 success=yes
>>> exit=10 a0=8a8dc90 a1=8002 a2=0 a3=bfe7f998 items=0 ppid=1265 pid=22329
>>> auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505
>>> sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap"
>>> exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0
>>> key=(null) type=AVC msg=audit(1343002203.689:153238): avc:  denied  {
>>> open } for  pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1
>>> ino=1046322 scontext=system_u:system_r:dovecot_t:s0 
>>> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file type=AVC 
>>> msg=audit(1343002203.689:153238): avc:  denied  { read write } for 
>>> pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322 
>>> scontext=system_u:system_r:dovecot_t:s0 
>>> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file ----
>>> 
>>> selinux-policy-targeted-3.7.19-155.el6_3.noarch
>>> 
>>> Have I missed something?
>>> 
>>> Thanks, Vadym
>>> 
>>> 
>>> 
>>> -- selinux mailing list selinux at lists.fedoraproject.org 
>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>> 
>> Please open a bugzilla. Since this is allowed in Fedora it will likely
>> be allowed in an Update.
> 
> 
> It looks like somebody already did, should have checked bugzilla first,
> sorry.
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=836241
> 
> Thanks, Vadym
> 
> 

Yup, Miroslav seems to have beat me to it with a fix also.  Try to packages on
people.redhat.com/dwalsh/SELinux/RHEL6

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAlAOp2AACgkQrlYvE4MpobP0cgCfZ2WU1gzQjAjDCAmjDX0nLHut
BokAoIiDvhOz0jyP6ZxkK0tUCS5yMs7Z
=/yb1
-----END PGP SIGNATURE-----