Policy prevents sendmail restarting
We have an email configuration package that often needs to restart
sendmail when it is upgraded. To make updates as easy as possible for
the users, it has a trigger script on sendmail that contains
"/etc/rc.d/init.d/sendmail condrestart", so that they don't have to
remember to do that themselves.
This worked fine on CentOS 4. On CentOS 5 it has a problem:
# rpm -qa selinux\*
selinux-policy-targeted-2.4.6-255.el5_4.3
selinux-policy-2.4.6-255.el5_4.3
selinux-policy-devel-2.4.6-255.el5_4.3
Apr 29 12:40:27 ict sm-msp-queue[4024]: unable to write pid to
/var/run/sm-client.pid: Permission denied
time->Thu Apr 29 12:40:27 2010
type=SYSCALL msg=audit(1272541227.852:97659096): arch=40000003
syscall=196 success=no exit=-13 a0=bfec70d8 a1=bfec6f70 a2=4efff4 a3=3
items=0 ppid=4023 pid=4024 auid=783 uid=51 gid=51 euid=51 suid=51
fsuid=51 egid=51 sgid=51 fsgid=51 tty=(none) ses=23989 comm="sendmail"
exe="/usr/sbin/sendmail.sendmail" subj=user_u:system_r:system_mail_t:s0
key=(null)
type=AVC msg=audit(1272541227.852:97659096): avc: denied { getattr }
for pid=4024 comm="sendmail" path="/var/run/sm-client.pid" dev=dm-4
ino=1097779 scontext=user_u:system_r:system_mail_t:s0
tcontext=system_u:object_r:sendmail_var_run_t:s0 tclass=file
A manual restart of sendmail works. This is because of the following
transition rules:
type_transition unconfined_t sendmail_exec_t : process sendmail_t;
type_transition initrc_t sendmail_exec_t : process sendmail_t;
type_transition rpm_script_t sendmail_exec_t : process system_mail_t;
In other words, being run from an rpm script does not give sendmail
enough access to restart. I don't know why there wasn't a similar error
for /var/run/sendmail.pid, though.
Moray.
"To err is human. To purr, feline"