Problem with SELinux and Postfix (sending from Python scripts)

[Jeff Coffler]

Hi folks,

I found this link that had a similar (but not identical) problem:

http://www.redhat.com/archives/fedora-selinux-list/2004-December/msg00033...

O/S: Fedora Core5
Mail server: Postfix
SELinux: Enabled.

Basically, the problem is this.  When I try to send E-Mail from a Python 
script, Postfix fails.  In the maillog file, I see:

Apr 24 13:53:57 miffy postfix/pickup[29094]: warning: maildrop/2104D276B2A: 
Permission denied

In messages, I see:

Apr 24 13:57:58 miffy kernel: audit(1145912278.348:688): avc: denied { 
getattr } for pid=29094 comm="pickup" name="2104D276B2A" dev=sda3 
ino=2583338 scontext=root:system_r:postfix_pickup_t:s0 
tcontext=root:object_r:postfix_spool_t:s0 tclass=file

If I set SELinux to permissive mode, it works fine.

Is this an SELinux policy problem?  How can I go about fixing this?  I'd 
prefer to run with SELinux enabled ...

    Thanks!

    -- Jeff

[Daniel J Walsh]

Jeff Coffler wrote:
>  Hi folks,
>
>  I found this link that had a similar (but not identical) problem:
>
>  http://www.redhat.com/archives/fedora-selinux-list/2004-December/msg00033... 
>
>
>  O/S: Fedora Core5
>  Mail server: Postfix
>  SELinux: Enabled.
>
>  Basically, the problem is this.  When I try to send E-Mail from a 
>  Python script, Postfix fails.  In the maillog file, I see:
>
>  Apr 24 13:53:57 miffy postfix/pickup[29094]: warning: 
>  maildrop/2104D276B2A: Permission denied
>
>  In messages, I see:
>
>  Apr 24 13:57:58 miffy kernel: audit(1145912278.348:688): avc: denied { 
>  getattr } for pid=29094 comm="pickup" name="2104D276B2A" dev=sda3 
>  ino=2583338 scontext=root:system_r:postfix_pickup_t:s0 
>  tcontext=root:object_r:postfix_spool_t:s0 tclass=file
>
>  If I set SELinux to permissive mode, it works fine.
>
>  Is this an SELinux policy problem?  How can I go about fixing this?  
>  I'd prefer to run with SELinux enabled ...
>  
# grep postfix_spool /var/log/message | audit2allow -M postfixpickup
# semodule -i postfixpickup.pp

Will fix it for now.

I will update policy to allow searching of this directory

>     Thanks!
>
>     -- Jeff
>  -- 
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Jeff Coffler]

> > Is this an SELinux policy problem?  How can I go about fixing
> this?  I'd 
> > prefer to run with SELinux enabled ...
> >
>  # grep postfix_spool /var/log/message | audit2allow -M postfixpickup
>  # semodule -i postfixpickup.pp
>
>  Will fix it for now.
>
>  I will update policy to allow searching of this directory 
Hmm, this didn't work ...

[root jeff]# grep postfix_spool /var/log/messages | audit2allow -M 
postfixpickup
Generating type enforcment file: postfixpickup.te
Compiling policy
checkmodule -M -m -o postfixpickup.mod postfixpickup.te
semodule_package -o postfixpickup.pp -m postfixpickup.mod

******************** IMPORTANT ***********************

In order to load this newly created policy package into the kernel,
you are required to execute

semodule -i postfixpickup.pp


[root jeff]# semodule -i postfixpickup.pp
slimserver homedir /usr/local/slimserver or its parent directory conflicts 
with a
defined context in /etc/selinux/targeted/contexts/files/file_contexts,
/usr/sbin/genhomedircon will not create a new context.
[root jeff]# grep -i slim /etc/selinux/targeted/contexts/files/file_contexts
[root jeff]#

I'm not sure why it's complaining about slimserver since there's no
"slim" 
in that file.  I could deinstall that to do the semodule command, then 
reinstall.  Or I could wait until you guys push out the next SELinux policy, 
then enable SELinux.

Suggestions?

Thanks!

    -- Jeff

[Daniel J Walsh]

Jeff Coffler wrote:
> >> Is this an SELinux policy problem?  How can I go about fixing
> this?  
> >> I'd prefer to run with SELinux enabled ...
> >>
> > # grep postfix_spool /var/log/message | audit2allow -M postfixpickup
> > # semodule -i postfixpickup.pp
> >
> > Will fix it for now.
> >
> > I will update policy to allow searching of this directory
>
>  Hmm, this didn't work ...
>
>  [root jeff]# grep postfix_spool /var/log/messages | audit2allow -M 
>  postfixpickup
>  Generating type enforcment file: postfixpickup.te
>  Compiling policy
>  checkmodule -M -m -o postfixpickup.mod postfixpickup.te
>  semodule_package -o postfixpickup.pp -m postfixpickup.mod
>
>  ******************** IMPORTANT ***********************
>
>  In order to load this newly created policy package into the kernel,
>  you are required to execute
>
>  semodule -i postfixpickup.pp
>
>
>  [root jeff]# semodule -i postfixpickup.pp
>  slimserver homedir /usr/local/slimserver or its parent directory 
>  conflicts with a
>  defined context in /etc/selinux/targeted/contexts/files/file_contexts,
>  /usr/sbin/genhomedircon will not create a new context.
>  [root jeff]# grep -i slim 
>  /etc/selinux/targeted/contexts/files/file_contexts
>  [root jeff]#
>
>  I'm not sure why it's complaining about slimserver since there's no 
>  "slim" in that file.  I could deinstall that to do the semodule 
>  command, then reinstall.  Or I could wait until you guys push out the 
>  next SELinux policy, then enable SELinux.
>
>  Suggestions?
>
>  Thanks!
>
>     -- Jeff  
Is there a password entry for slimserver?  If yes make sure it has a 
shell of /sbin/nologin or /bin/false.  Then you can run genhomedircon