On Mon, 2006-06-26 at 12:31 +0100, Paul Howarth wrote:
Marc Schwartz wrote:
> After loading the updated modules, you'll need to do:
>>
>> # restorecon -rv /var/dcc
>
> Done and new mydcc policy installed:
>
> # semodule -l
> amavis 1.0.4
> clamav 1.0.1
> dcc 1.0.0
> myclamav 0.1.1
> mydcc 0.1.6
> mypostfix 0.1.0
> mypyzor 0.2.1
> myspamassassin 0.1.1
> procmail 0.5.4
> pyzor 1.0.1
> razor 1.0.0
>
>
> New avc's:
>
> type=AVC msg=audit(1151269000.770:5837): avc: denied { search } for pid=23000
comm="dccproc" name="dcc" dev=dm-1 ino=58510
scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:dcc_var_t:s0 tclass=dir
> type=SYSCALL msg=audit(1151269000.770:5837): arch=40000003 syscall=12 success=yes
exit=0 a0=bfdb1202 a1=0 a2=4891eff4 a3=37 items=1 pid=23000 auid=4294967295 uid=500 gid=0
euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0 tty=(none) comm="dccproc"
exe="/usr/local/bin/dccproc" subj=system_u:system_r:spamd_t:s0
> type=CWD msg=audit(1151269000.770:5837): cwd="/"
> type=PATH msg=audit(1151269000.770:5837): item=0 name="/var/dcc"
inode=58510 dev=fd:01 mode=040755 ouid=0 ogid=0 rdev=00:00
obj=system_u:object_r:dcc_var_t:s0
dccproc is still running in the spamd_t domain; for some reason the
domain transition hasn't happened.
Can you check that the dccproc being invoked by spamassassin is the one
in /usr/local/bin and that its context type is dcc_client_exec_t?
dccproc only exists in two locations:
/var/dcc/build/dcc/dccproc/dccproc
and
/usr/local/bin/dccproc
The former is where dcc does it's build each night.
It was:
user_u:object_r:bin_t
I ran restorecon on it and now:
system_u:object_r:dcc_client_exec_t
However, thinking that the build process might change the context, I
manually ran updatedcc via sudo from the CLI. Sure enough, the context
is back to:
user_u:object_r:bin_t
So the change in context will occur every night. :-(
Should I add a restorecon to crontab after updatedcc runs?
Also, there is some configuration info here:
http://www.rhyolite.com/anti-spam/dcc/dcc-tree/INSTALL.html
where some settings (ie. UID) might be apropos here. If something makes
sense to change, let me know.
I will reply to your other mail shortly. I made some changes to the
razor and pyzor configs that will take a bit to write up, but appear to
address the multiple user folder locations.
Thanks,
Marc