selinux + mailman +postfix security problem (F14)

[Fulko Hew]

On Thu, Aug 25, 2011 at 12:20 PM, Marcos Luis Ortiz Valmaseda <
marcosluis2186 at googlemail.com> wrote:

> Well, test it and say the response to us.
>

So the first issue was:
SELinux is preventing /usr/sbin/postalias from search access on the
directory /etc/postfix.

It then complained (one at a time) about:
SELinux is preventing /usr/sbin/postalias from read access on the file
/etc/postfix/main.cf.
SELinux is preventing /usr/sbin/postalias from open access on the file
/etc/postfix/main.cf.
SELinux is preventing /usr/sbin/postalias from getattr access on the file
/etc/postfix/main.cf.

So I  redid 'audit2allow' over and over to get past each problem.

...I can continue to do this, or disable SELinux, but I shouldn't have to,
   something else is wrong here.  ;-(

Finally, I can now create a new mailing list.


>
> 2011/8/25 Fulko Hew <fulko.hew at gmail.com>
>
>>
>>
>> On Thu, Aug 25, 2011 at 12:13 PM, Marcos Luis Ortiz Valmaseda <
>> marcosluis2186 at googlemail.com> wrote:
>>
>>> Can you provide the ls -Z of your content in /etc/mailman/aliases
>>>
>>
>>  [root at netwatch log]# ls -Z /etc/mailman/aliases
>> -rw-rw----. root mailman unconfined_u:object_r:mailman_data_t:s0
>> /etc/mailman/aliases
>>
>> A advice:, use sealert to see a more human-readable approach to analyze
>>> the SELinux logs.
>>>
>>
>> While waiting for a response from the list... I had just (discovered and)
>> done a:
>>
>> # grep postalias /var/log/audit/audit.log | audit2allow -M mypol
>> # semodule -i mypol.pp
>>
>> But I haven't tested it yet.
>>
>>
>>
>>  2011/8/25 Fulko Hew <fulko.hew at gmail.com>
>>>
>>>> On Fedora 14, I am setting up postfix and mailman.
>>>>
>>>> I had this working once, but I decided to yum erase postfix and mailman
>>>> and redo the configuration to prove I knew how to recreate it.
>>>>
>>>> Turns out I don't know how to recreate a working combination
>>>> because when creating a new list I now have mailman error log that
>>>> talks about:
>>>>
>>>> command failed: /usr/sbin/postalias /etc/mailman/aliases (status: 1,
>>>> Operation not permitted)
>>>>
>>>> and a corresponding AVC error:
>>>>
>>>> Aug 25 10:28:54 (null) (null): audit(1314282534.501:4326): avc: denied {
>>>> search } for
>>>> pid=12121 comm=postalias name=postfix ino=295074 dev=dm-0
>>>> scontext=system_u:system_r:mailman_cgi_t:s0
>>>> tcontext=system_u:object_r:postfix_etc_t:s0 tclass=dir
>>>>
>>>> Suggestions?
>>>>
>>>> Fulko
>>>>
>>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.fedoraproject.org/pipermail/users/attachments/20110912/27261e21/attachment.html