People running Postfix in FC5 not running Selinux?

[Stephen John Smoogen]

I installed a system from the original FC5 disks and updated to latest
versions in yum repos. I changed over to postfix and found that it
wasnt working for some reason.. no errros to /var/log/messages or
/var/log/secure.. and I completely forgot for a day to look at audit.

When my brain turned back on I found that postfix didnt start because
a it was trying to use a pam entry that I had put in pam_tally.so in.
Woops. Fixed that.. but postfix still wouldnt start up.
This also showed me that my /etc/services file needed a relabel as I
had put in a more verbose one. So I did a complete system relabel in
case I missed something else.

postfix was able to start email but could not do a mailq
doing a mailq showed me things like

allow postfix_local_t initrc_var_run_t:file { read write };
allow postfix_showq_t initrc_var_run_t:file { read write };

type=AVC msg=audit(1159574724.622:397): avc:  denied  { read write }
for  pid=2621 comm="local" name="unix.local" dev=dm-3 ino=163870
scontext=system_u:system_r:postfix_local_t:s0
tcontext=user_u:object_r:initrc_var_run_t:s0 tclass=file
        Was caused by:
                Missing or disabled TE allow rule.
                Allow rules may exist but be disabled by boolean
settings; check boolean settings.
                You can see the necessary allow rules by running
audit2allow with this audit message as input.

type=AVC msg=audit(1159574753.636:398): avc:  denied  { read write }
for  pid=2625 comm="showq" name="unix.showq" dev=dm-3 ino=163871
scontext=system_u:system_r:postfix_showq_t:s0
tcontext=user_u:object_r:initrc_var_run_t:s0 tclass=file
        Was caused by:
                Missing or disabled TE allow rule.
                Allow rules may exist but be disabled by boolean
settings; check boolean settings.
                You can see the necessary allow rules by running
audit2allow with this audit message as input.


Not sure what I should do next. Turning off the selinux
selinux-policy-targeted-2.3.7-2.fc5
selinux-policy-2.3.7-2.fc5



-- 
Stephen J Smoogen. -- CSIRT/Linux System Administrator
How far that little candle throws his beams! So shines a good deed
in a naughty world. = Shakespeare. "The Merchant of Venice"

[Stephen John Smoogen]

On 9/29/06, Stephen John Smoogen <smooge(a)gmail.com&gt; wrote:
>  I installed a system from the original FC5 disks and updated to
> latest
>  versions in yum repos. I changed over to postfix and found that it
>  wasnt working for some reason.. no errros to /var/log/messages or
>  /var/log/secure.. and I completely forgot for a day to look at audit.
>  
That has to be the worst subject I could have come up with. Probably
not enough sleep.

...
>  postfix was able to start email but could not do a mailq
>  doing a mailq showed me things like
>
>  allow postfix_local_t initrc_var_run_t:file { read write };
>  allow postfix_showq_t initrc_var_run_t:file { read write };
>
>  type=AVC msg=audit(1159574724.622:397): avc:  denied  { read write }
>  for  pid=2621 comm="local" name="unix.local" dev=dm-3 ino=163870
>  scontext=system_u:system_r:postfix_local_t:s0
>  tcontext=user_u:object_r:initrc_var_run_t:s0 tclass=file
>          Was caused by:
>                  Missing or disabled TE allow rule.
>                  Allow rules may exist but be disabled by boolean
>  settings; check boolean settings.
>                  You can see the necessary allow rules by running
>  audit2allow with this audit message as input.
>
>  type=AVC msg=audit(1159574753.636:398): avc:  denied  { read write }
>  for  pid=2625 comm="showq" name="unix.showq" dev=dm-3 ino=163871
>  scontext=system_u:system_r:postfix_showq_t:s0
>  tcontext=user_u:object_r:initrc_var_run_t:s0 tclass=file
>          Was caused by:
>                  Missing or disabled TE allow rule.
>                  Allow rules may exist but be disabled by boolean
>  settings; check boolean settings.
>                  You can see the necessary allow rules by running
>  audit2allow with this audit message as input.
>
>
>  Not sure what I should do next. Turning off the selinux
>  selinux-policy-targeted-2.3.7-2.fc5
>  selinux-policy-2.3.7-2.fc5
>  

-- 
Stephen J Smoogen. -- CSIRT/Linux System Administrator
How far that little candle throws his beams! So shines a good deed
in a naughty world. = Shakespeare. "The Merchant of Venice"

[Daniel J Walsh]

Stephen John Smoogen wrote:
>  On 9/29/06, Stephen John Smoogen <smooge(a)gmail.com&gt; wrote:
> > I installed a system from the original FC5 disks and updated to latest
> > versions in yum repos. I changed over to postfix and found that it
> > wasnt working for some reason.. no errros to /var/log/messages or
> > /var/log/secure.. and I completely forgot for a day to look at audit.
> >
>
>  That has to be the worst subject I could have come up with. Probably
>  not enough sleep.
>
>  ...
> > postfix was able to start email but could not do a mailq
> > doing a mailq showed me things like
> >
> > allow postfix_local_t initrc_var_run_t:file { read write };
> > allow postfix_showq_t initrc_var_run_t:file { read write };
> >
> > type=AVC msg=audit(1159574724.622:397): avc:  denied  { read write }
> > for  pid=2621 comm="local" name="unix.local" dev=dm-3 ino=163870
> > scontext=system_u:system_r:postfix_local_t:s0
> > tcontext=user_u:object_r:initrc_var_run_t:s0 tclass=file
> >         Was caused by:
> >                 Missing or disabled TE allow rule.
> >                 Allow rules may exist but be disabled by boolean
> > settings; check boolean settings.
> >                 You can see the necessary allow rules by running
> > audit2allow with this audit message as input.
> >
> > type=AVC msg=audit(1159574753.636:398): avc:  denied  { read write }
> > for  pid=2625 comm="showq" name="unix.showq" dev=dm-3 ino=163871
> > scontext=system_u:system_r:postfix_showq_t:s0
> > tcontext=user_u:object_r:initrc_var_run_t:s0 tclass=file
> >         Was caused by:
> >                 Missing or disabled TE allow rule.
> >                 Allow rules may exist but be disabled by boolean
> > settings; check boolean settings.
> >                 You can see the necessary allow rules by running
> > audit2allow with this audit message as input.
> >
> >
> > Not sure what I should do next. Turning off the selinux
> > selinux-policy-targeted-2.3.7-2.fc5
> > selinux-policy-2.3.7-2.fc5
> >
>  
This looks like a labeing problem.   Which directory are  unix.showq and 
unix.local in?

Labeled initrc_var_run_t means they were created in an init script and 
SELinux policy is denying
access to these files.