Thank you for replying.
On 2/5/19 2:06 AM, Thomas Mueller wrote:
On 2/4/19 8:55 PM, Robert Moskowitz wrote:
> I am working with Centos7:
>
> I have configured Dovecot to connect to mysqld via socket:
>
> connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix
> password=Postfix_Database_Password
>
> I test sending a message with
>
> sendmail -i rgm(a)test.htt-consult.com < README
>
> This fails with the following message in maillog
>
> Feb 4 11:28:48 klovia dovecot: dict(13122): Error:
> mysql(/var/lib/mysql/mysql.sock): Connect failed to database
> (postfix): Can't connect to local MySQL server through socket
> '/var/lib/mysql/mysql.sock' (13) - waiting for 25 seconds before retry
>
SELinux denials are logged with auditd:
# show some summary (recent = last 10min)
aureport --avc --start recent
A number of dovecot_t errors. e.g.
18. 02/05/2019 08:38:44 dict system_u:system_r:dovecot_t:s0 195 file
getattr unconfined_u:object_r:mysqld_etc_t:s0 denied 578
But after I setenforce 0, I see:
32. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 195 file
getattr unconfined_u:object_r:mysqld_etc_t:s0 denied 593
33. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file read
unconfined_u:object_r:mysqld_etc_t:s0 denied 594
34. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file open
unconfined_u:object_r:mysqld_etc_t:s0 denied 594
35. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 322 dir read
unconfined_u:object_r:mysqld_etc_t:s0 denied 595
36. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 195 file
getattr system_u:object_r:mysqld_etc_t:s0 denied 596
37. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file read
system_u:object_r:mysqld_etc_t:s0 denied 597
38. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file open
system_u:object_r:mysqld_etc_t:s0 denied 597
39. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 283
unix_stream_socket connectto system_u:system_r:mysqld_t:s0 denied 598
# if it's the dovecot_t type that spits AVC denials, then you probably
could create dummy policy by using the audit2allow tool:
ausearch -m AVC --context dovecot_t | audit2allow --reference -m
dovecot_mysql_custom
This throws an error:
could not open interface info [/var/lib/sepolgen/interface_info]
> But I was hoping that there were better tools now with Centos7. I
> checked for setsebool at:
>
>
https://linux.die.net/man/8/mysqld_selinux
I would lookup this the other way around: is there a boolean that
allows dovecot to connect to mysql?
but there doesnt seem to be one:
https://github.com/fedora-selinux/selinux-policy-contrib/blob/rawhide/dov...
the mysql policy provides an interfacee to allow access to it's socket:
https://github.com/fedora-selinux/selinux-policy-contrib/blob/rawhide/mys...
Using this is rather beyond me. I would need a lot of guidance.
this could be used in the policy allowing the access.
- Thomas
_______________________________________________
selinux mailing list -- selinux(a)lists.fedoraproject.org
To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject...