On 2/4/19 8:55 PM, Robert Moskowitz wrote:
I am working with Centos7:
I have configured Dovecot to connect to mysqld via socket:
connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix
password=Postfix_Database_Password
I test sending a message with
sendmail -i rgm(a)test.htt-consult.com < README
This fails with the following message in maillog
Feb 4 11:28:48 klovia dovecot: dict(13122): Error:
mysql(/var/lib/mysql/mysql.sock): Connect failed to database
(postfix): Can't connect to local MySQL server through socket
'/var/lib/mysql/mysql.sock' (13) - waiting for 25 seconds before retry
SELinux denials are logged with auditd:
# show some summary (recent = last 10min)
aureport --avc --start recent
# if it's the dovecot_t type that spits AVC denials, then you probably
could create dummy policy by using the audit2allow tool:
ausearch -m AVC --context dovecot_t | audit2allow --reference -m
dovecot_mysql_custom
But I was hoping that there were better tools now with Centos7. I
checked for setsebool at:
https://linux.die.net/man/8/mysqld_selinux
I would lookup this the other way around: is there a boolean that allows
dovecot to connect to mysql?
but there doesnt seem to be one:
https://github.com/fedora-selinux/selinux-policy-contrib/blob/rawhide/dov...
the mysql policy provides an interfacee to allow access to it's socket:
https://github.com/fedora-selinux/selinux-policy-contrib/blob/rawhide/mys...
this could be used in the policy allowing the access.
- Thomas