8:19 a.m.
Hi Folks -
Using FC4 postfix with 'postgrey', a greylisting service that
communicates via a unix socket:
# ll -Z /var/spool/postfix/postgrey/socket
srw-rw-rw- postgrey nobody root:object_r:postfix_spool_t
/var/spool/postfix/postgrey/socket
After recent updates:
Sep 27 09:25:17 Updated: audit-libs.i386 1.0.4-1.fc4
Sep 27 09:25:31 Updated: audit.x86_64 1.0.4-1.fc4
Sep 27 09:25:34 Updated: selinux-policy-targeted.noarch 1.27.1-2.2
Sep 27 09:25:35 Updated: audit-libs.x86_64 1.0.4-1.fc4
and a reboot, the socket is not available for postfix to open:
Sep 27 14:08:56 siamese postfix/smtpd[13486]: warning: connect to
/var/spool/postfix/postgrey/socket: Permission denied
Sep 27 14:08:56 siamese postfix/smtpd[13486]: warning: problem talking
to server /var/spool/postfix/postgrey/socket: Permission denied
Mail is then getting kicked because of this with, eg:
Sep 27 14:08:57 siamese postfix/smtpd[13486]: NOQUEUE: reject: RCPT from
hormel.redhat.com[209.132.177.30]: 450 Server configuration problem;
from=<fedora-list-bounces(a)redhat.com> to=<andy(a)warmcat.com> proto=ESMTP
helo=<hormel.redhat.com>
However there are no avc complaints in /var/log/messages. Turning off
enforcing (of the targetted mode this is) in system-config-securitylevel
enables mail to work, therefore I deduce it is to do with selinux
despite the lack of complaints.
The socket is live alright as it appears (twice?) on:
# lsof -n | grep postgrey\/socket
postgrey 12989 postgrey 5u unix 0xffff81007995d800
77801 /var/spool/postfix/postgrey/socket
postgrey 12989 postgrey 9u unix 0xffff810005ed3800
92050 /var/spool/postfix/postgrey/socket
Any advice?
-Andy
8:37 a.m.
Andy Green wrote:
Sep 27 14:08:56 siamese postfix/smtpd[13486]: warning: connect to
/var/spool/postfix/postgrey/socket: Permission denied
...
However there are no avc complaints in /var/log/messages. Turning
off
I discover /var/log/audit/audit.log ... much neater once you know about
it :-) This is the AVC message:
type=AVC msg=audit(1127827818.253:472): avc: denied { connectto } for
pid=13783 comm="smtpd" name="socket"
scontext=root:system_r:postfix_smtpd_t tcontext=root:system_r:initrc_t
tclass=unix_stream_socket
type=SYSCALL msg=audit(1127827818.253:472): arch=c000003e syscall=42
success=yes exit=0 a0=14 a1=7fffffa59ec0 a2=6e a3=7fffffa59ec2 items=1
pid=13783 auid=500 uid=89 gid=89 euid=89 suid=89 fsuid=89 egid=89
sgid=89 fsgid=89 comm="smtpd" exe="/usr/libexec/postfix/smtpd"
type=AVC_PATH msg=audit(1127827818.253:472):
path="/var/spool/postfix/postgrey/socket"
type=SOCKADDR msg=audit(1127827818.253:472):
saddr=01002F7661722F73706F6F6C2F706F73746669782F706F7374677265792F736F636B65740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
type=PATH msg=audit(1127827818.253:472): item=0 flags=1 inode=3342296
dev=fd:00 mode=0140666 ouid=95 ogid=99 rdev=00:00
-Andy
9:35 a.m.
Andy Green wrote:
Andy Green wrote:
>Sep 27 14:08:56 siamese postfix/smtpd[13486]: warning: connect to
>/var/spool/postfix/postgrey/socket: Permission denied
>
>
...
>However there are no avc complaints in /var/log/messages. Turning off
>
>
I discover /var/log/audit/audit.log ... much neater once you know about
it :-) This is the AVC message:
type=AVC msg=audit(1127827818.253:472): avc: denied { connectto } for
pid=13783 comm="smtpd" name="socket"
scontext=root:system_r:postfix_smtpd_t tcontext=root:system_r:initrc_t
tclass=unix_stream_socket
type=SYSCALL msg=audit(1127827818.253:472): arch=c000003e syscall=42
success=yes exit=0 a0=14 a1=7fffffa59ec0 a2=6e a3=7fffffa59ec2 items=1
pid=13783 auid=500 uid=89 gid=89 euid=89 suid=89 fsuid=89 egid=89
sgid=89 fsgid=89 comm="smtpd" exe="/usr/libexec/postfix/smtpd"
type=AVC_PATH msg=audit(1127827818.253:472):
path="/var/spool/postfix/postgrey/socket"
type=SOCKADDR msg=audit(1127827818.253:472):
saddr=01002F7661722F73706F6F6C2F706F73746669782F706F7374677265792F736F636B65740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
type=PATH msg=audit(1127827818.253:472): item=0 flags=1 inode=3342296
dev=fd:00 mode=0140666 ouid=95 ogid=99 rdev=00:00
If you install selinux-policy-targeted-sources and add this line to
/etc/selinux/policy/src/targeted/domains/misc/local.te
allow postfix_smtpd_t initrc_t:unix_stream_socket connectto;
And do a
make -c /etc/selinux/targeted/src/policy load
Does that fix your problem?
-Andy
------------------------------------------------------------------------
--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
--
10:58 a.m.
Daniel J Walsh wrote:
If you install selinux-policy-targeted-sources and add this line to
/etc/selinux/policy/src/targeted/domains/misc/local.te
allow postfix_smtpd_t initrc_t:unix_stream_socket connectto;
And do a
make -c /etc/selinux/targeted/src/policy load
Does that fix your problem?
In short... no. I used this path:
/etc/selinux/targeted/src/policy/domains/misc/local.te
and make -C, but on completion nothing was changed. I rebooted (with a
gratuitous relabel thrown in) and still it was broken. Was there
another obvious step I should have taken after the make -C ... load?
-Andy
11:58 a.m.
Andy Green wrote:
Daniel J Walsh wrote:
>If you install selinux-policy-targeted-sources and add this line to
>/etc/selinux/policy/src/targeted/domains/misc/local.te
>
>allow postfix_smtpd_t initrc_t:unix_stream_socket connectto;
>
>And do a
>
>make -c /etc/selinux/targeted/src/policy load
>
>Does that fix your problem?
>
>
In short... no. I used this path:
/etc/selinux/targeted/src/policy/domains/misc/local.te
and make -C, but on completion nothing was changed. I rebooted (with a
gratuitous relabel thrown in) and still it was broken. Was there
another obvious step I should have taken after the make -C ... load?
-Andy
No. But are you seeing any AVC messages? Try to run with setenforce 0,
and see what AVC messages are generated.
No need to relabel or reboot.
Dan
--
1:58 p.m.
Daniel J Walsh wrote:
No. But are you seeing any AVC messages? Try to run with setenforce
0,
and see what AVC messages are generated.
No need to relabel or reboot.
I saw a notification of a new version of the targeted policy in the
testing repo fly by, so I downloaded it and updated to it.
* Tue Sep 27 2005 Dan Walsh <dwalsh(a)redhat.com> 1.27.1-2.3
- Fixes for postfix, amanda, bluetooth
- Merge in changes from Rawhide.
In the meanwhile my x86_64 postalias (a postfix utility) started
segfaulting for no apparent reason (with or without selinux, and after
reloading it from the rpm), since this is in the /etc/init.d/ script for
postfix this killed postfix as a whole. strace did not show any funny
business nor did -v -v. I removed the x86_64 postfix package and
replaced it with the x86 postfix package. That worked fine without
altering any config except returning the /etc/postfix/main.cf back to my
original one. No idea what that was about.
At the end of all this I can go back to enforcing without errors or avc
messages, so I guess that is 'fixed' by the new policy rpm and/or the
local.te line. Thanks for the help and sorry for the unclear nature of
the resolution.
-Andy
4:07 a.m.
On Tuesday 27 September 2005 23:19, Andy Green <andy(a)warmcat.com> wrote:
Using FC4 postfix with 'postgrey', a greylisting service
that
communicates via a unix socket:
Best to install selinux-policy-strict-sources and copy postgrey.te and
postgrey.fc from there. Running postgrey in it's own domain is much better
than any other option.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
6774
days inactive
6785
days old
selinux@lists.fedoraproject.org
6 comments
3 participants
participants (3)
-
Andy Green -
Daniel J Walsh -
Russell Coker