I have a couple of problems with Evolution/OpenOffice running on FC4/strict with policy:
selinux-policy-strict-sources-1.27.1-2.3
The first, relatively simple, issue is that the user_evolution_t policy doesn't seem to have provision for reading /var/spool/mail. I have sendmail setup to forward root mail to my local non-root account, and then Evolution setup to read the ensuing Unix mail spool locally in addition to my remote IMAP/POP3 accounts.
The extra var_spool_t and mail_spool_t policy listed below seems to do the trick, though obviously a more complete solution would require proper "macro-ising" to take account of staff_evolution_t and so on.
As far as I can tell, there isn't a boolean switch to allow for this.
The second, slightly more intractable problem is that of OpenOffice/Evolution integration.
I have the allow_execmem boolean enabled to allow for a plain launch of OpenOffice, but I find that an additional execmem policy - see below - is needed to allow for the launch of OO from within Evolution's "attachment view dialog" as it now has its own user_evolution_t domain which seems to ignore the allow_execmem boolean.
The execmem policy is still not sufficient to allow me to launch OO from Evolution. I've added some extra policy to cope with denial messages that I've seen for this socket file
/tmp/OSL_PIPE_500_SingleOfficeIPC_2df8e6ac565346ee4ccc8ac992ddaa83
which OO creates, but this is still not enough to make OO fire up.
The socket created by OO appears to get left behind once OO has finished, which makes me suspect that part of the problem is that the socket has a different file_context when created from user_t as opposed to user_evolution_t.
With my current patched policy, I get no further SELinux denial messages, so debugging the problem has become trickier. Presumably there is a dontaudit policy somewhere suppressing the error message I'm interested in, but I haven't tracked it down yet.
Any suggestions, folks?
Current patches to strict policy:
=================================================================
cat /etc/selinux/strict/src/policy/domains/program/localpolicy.te # Miscellaneous Local SELinux policy not # covered by other .te configuration ...
############################################################## # Patch to allow Evolution to read home mail spools # Seemingly still required as not included in default policy allow user_evolution_t var_spool_t:dir { search }; allow user_evolution_t mail_spool_t:dir { read getattr search }; allow user_evolution_t mail_spool_t:file { read getattr write };
...
############################################################# # Patch to allow Evolution to launch OpenOffice.... allow user_evolution_t self:process { execmem }; auditallow user_evolution_t self:process { execmem };
############################################################# # Patch to allow OpenOffice to write to a temporary socket.... allow user_t { user_tmp_t tmp_t}:sock_file { create write unlink }; auditallow user_t { user_tmp_t tmp_t}:sock_file { create write unlink };
...
# Patches to allow OpenOffice to write to a temporary socket....from Evolution allow user_evolution_t { user_tmp_t tmp_t}:sock_file { create write unlink }; auditallow user_evolution_t { user_tmp_t tmp_t}:sock_file { create write unlink };