On 2/5/19 2:52 PM, Robert Moskowitz wrote:
Thank you for replying.
On 2/5/19 2:06 AM, Thomas Mueller wrote:
>
> On 2/4/19 8:55 PM, Robert Moskowitz wrote:
>> I am working with Centos7:
>>
>> I have configured Dovecot to connect to mysqld via socket:
>>
>> connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix
>> password=Postfix_Database_Password
>>
>> I test sending a message with
>>
>> sendmail -i rgm(a)test.htt-consult.com < README
>>
>> This fails with the following message in maillog
>>
>> Feb 4 11:28:48 klovia dovecot: dict(13122): Error:
>> mysql(/var/lib/mysql/mysql.sock): Connect failed to database
>> (postfix): Can't connect to local MySQL server through socket
>> '/var/lib/mysql/mysql.sock' (13) - waiting for 25 seconds before retry
>>
> SELinux denials are logged with auditd:
>
> # show some summary (recent = last 10min)
>
> aureport --avc --start recent
A number of dovecot_t errors. e.g.
18. 02/05/2019 08:38:44 dict system_u:system_r:dovecot_t:s0 195 file
getattr unconfined_u:object_r:mysqld_etc_t:s0 denied 578
But after I setenforce 0, I see:
32. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 195 file
getattr unconfined_u:object_r:mysqld_etc_t:s0 denied 593
33. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file
read unconfined_u:object_r:mysqld_etc_t:s0 denied 594
34. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file
open unconfined_u:object_r:mysqld_etc_t:s0 denied 594
35. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 322 dir
read unconfined_u:object_r:mysqld_etc_t:s0 denied 595
36. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 195 file
getattr system_u:object_r:mysqld_etc_t:s0 denied 596
37. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file
read system_u:object_r:mysqld_etc_t:s0 denied 597
38. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file
open system_u:object_r:mysqld_etc_t:s0 denied 597
39. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 283
unix_stream_socket connectto system_u:system_r:mysqld_t:s0 denied 598
>
> # if it's the dovecot_t type that spits AVC denials, then you
> probably could create dummy policy by using the audit2allow tool:
>
> ausearch -m AVC --context dovecot_t | audit2allow --reference -m
> dovecot_mysql_custom
This throws an error:
could not open interface info [/var/lib/sepolgen/interface_info]
running sepol-ifgen should fix this
but I really don't know what state the refpolicy is in with
Fedora/Redhat. The reply of Zdenek uses CIL (a new way of writing a
policy) - i don't know what the default is now and what is best to be used.
- Thomas