Postfix (FC7)

["Stanisław T. Findeisen"]

Hello

Hopefully you Fedora/SELinux developers already know that Postfix does 
not work correctly by default in Fedora Core 7?

         audit(1189079035.093:14): avc:  denied  { append } for 
pid=2573 comm="local" name="stf" dev=sda1 ino=5881977 
scontext=system_u:system_r:postfix_local_t:s0 
tcontext=root:object_r:mail_spool_t:s0 tclass=file

This used to happen to me when I tried (as an ordinary user) to send 
email to myself. The file that Postfix was trying to append to was my 
own mail file (/var/spool/mail/stf).

I had to add this rule:

         allow postfix_local_t mail_spool_t:file append;

What's more, it turned out that checkmodule (policy language compiler) 
is not present, so I had to install one from Fedora Core 6.

-- 
     "Serce medrcow jest w domu zaloby,
      a serce glupcow w domu wesela."     (Koh 7:4)

[Eric Paris]

On Fri, 2007-09-07 at 09:59 +0200, "Stanisław T. Findeisen" wrote:

[I'll let dan comment on the postfix policy]

>  What's more, it turned out that checkmodule (policy language
> compiler) 
>  is not present, so I had to install one from Fedora Core 6. 
[paris@localhost ~]$ cat /etc/fedora-release 
Fedora release 7 (Moonshine)
[paris@localhost ~]$ rpm -qf `which checkmodule`
checkpolicy-2.0.3-1.fc7
[paris@localhost ~]$ rpm -ql checkpolicy
/usr/bin/checkmodule
/usr/bin/checkpolicy
/usr/share/man/man8/checkmodule.8.gz
/usr/share/man/man8/checkpolicy.8.gz
[paris@localhost ~]$

Seems to be there for me.....

-Eric

["Stanisław T. Findeisen"]

Which Fedora version do you use? Mine is 64 bit.

Eric Paris wrote:
>  On Fri, 2007-09-07 at 09:59 +0200, "Stanisław T. Findeisen"
> wrote:
>  
>  [I'll let dan comment on the postfix policy]
>  
> > What's more, it turned out that checkmodule (policy language compiler) 
> > is not present, so I had to install one from Fedora Core 6.
>  
>  [paris@localhost ~]$ cat /etc/fedora-release 
>  Fedora release 7 (Moonshine)
>  [paris@localhost ~]$ rpm -qf `which checkmodule`
>  checkpolicy-2.0.3-1.fc7
>  [paris@localhost ~]$ rpm -ql checkpolicy
>  /usr/bin/checkmodule
>  /usr/bin/checkpolicy
>  /usr/share/man/man8/checkmodule.8.gz
>  /usr/share/man/man8/checkpolicy.8.gz
>  [paris@localhost ~]$
>  
>  Seems to be there for me.....
>  
>  -Eric
>  
>   
-- 
     "Serce medrcow jest w domu zaloby,
      a serce glupcow w domu wesela."     (Koh 7:4)

[Eric Paris]

On Fri, 2007-09-07 at 15:32 +0200, "Stanisław T. Findeisen" wrote:
>  Which Fedora version do you use? Mine is 64 bit. 
Huh, looks like you are right....  Anyway you could get the F7 version
right out of the build system rather than from F6.  

http://koji.fedoraproject.org/koji/buildinfo?buildID=7991

/me goes poking to find out where the x86_64 version is.

-Eric


>  
>  Eric Paris wrote:
>  > On Fri, 2007-09-07 at 09:59 +0200, "Stanisław T. Findeisen" wrote:
>  > 
>  > [I'll let dan comment on the postfix policy]
>  > 
>  >> What's more, it turned out that checkmodule (policy language compiler) 
>  >> is not present, so I had to install one from Fedora Core 6.
>  > 
>  > [paris@localhost ~]$ cat /etc/fedora-release 
>  > Fedora release 7 (Moonshine)
>  > [paris@localhost ~]$ rpm -qf `which checkmodule`
>  > checkpolicy-2.0.3-1.fc7
>  > [paris@localhost ~]$ rpm -ql checkpolicy
>  > /usr/bin/checkmodule
>  > /usr/bin/checkpolicy
>  > /usr/share/man/man8/checkmodule.8.gz
>  > /usr/share/man/man8/checkpolicy.8.gz
>  > [paris@localhost ~]$
>  > 
>  > Seems to be there for me.....
>  > 
>  > -Eric
>  > 
>  > 
>

[Eric Paris]

On Fri, 2007-09-07 at 09:47 -0400, Eric Paris wrote:
>  On Fri, 2007-09-07 at 15:32 +0200, "Stanisław T. Findeisen"
> wrote:
>  > Which Fedora version do you use? Mine is 64 bit.
>  
>  Huh, looks like you are right....  Anyway you could get the F7 version
>  right out of the build system rather than from F6.  
>  
>  http://koji.fedoraproject.org/koji/buildinfo?buildID=7991
>  
>  /me goes poking to find out where the x86_64 version is.
>  
>  -Eric 
Its in the fedora-updates repo.  Not sure why it isn't in the fedora
repo, but anyway if you have the fedora-updates repo enabled you should
be able to grab it with yum.  If not you can grab it from a mirror.

http://www.gtlib.gatech.edu/pub/fedora.redhat/linux/updates/7/x86_64/chec...

-Eric

>  
>  
>  > 
>  > Eric Paris wrote:
>  > > On Fri, 2007-09-07 at 09:59 +0200, "Stanisław T. Findeisen" wrote:
>  > > 
>  > > [I'll let dan comment on the postfix policy]
>  > > 
>  > >> What's more, it turned out that checkmodule (policy language compiler)
>
>  > >> is not present, so I had to install one from Fedora Core 6.
>  > > 
>  > > [paris@localhost ~]$ cat /etc/fedora-release 
>  > > Fedora release 7 (Moonshine)
>  > > [paris@localhost ~]$ rpm -qf `which checkmodule`
>  > > checkpolicy-2.0.3-1.fc7
>  > > [paris@localhost ~]$ rpm -ql checkpolicy
>  > > /usr/bin/checkmodule
>  > > /usr/bin/checkpolicy
>  > > /usr/share/man/man8/checkmodule.8.gz
>  > > /usr/share/man/man8/checkpolicy.8.gz
>  > > [paris@localhost ~]$
>  > > 
>  > > Seems to be there for me.....
>  > > 
>  > > -Eric
>  > > 
>  > > 
>  > 
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list

["Stanisław T. Findeisen"]

Thank you.

Eric Paris wrote:
>  On Fri, 2007-09-07 at 09:47 -0400, Eric Paris wrote:
> > On Fri, 2007-09-07 at 15:32 +0200, "Stanisław T. Findeisen" wrote:
> >> Which Fedora version do you use? Mine is 64 bit.
> > Huh, looks like you are right....  Anyway you could get the F7 version
> > right out of the build system rather than from F6.  
> >
> > http://koji.fedoraproject.org/koji/buildinfo?buildID=7991
> >
> > /me goes poking to find out where the x86_64 version is.
> >
> > -Eric
>  
>  Its in the fedora-updates repo.  Not sure why it isn't in the fedora
>  repo, but anyway if you have the fedora-updates repo enabled you should
>  be able to grab it with yum.  If not you can grab it from a mirror.
>  
>
> http://www.gtlib.gatech.edu/pub/fedora.redhat/linux/updates/7/x86_64/chec...
>  
>  -Eric
>  
> >
> >> Eric Paris wrote:
> >>> On Fri, 2007-09-07 at 09:59 +0200, "Stanisław T. Findeisen" wrote:
> >>>
> >>> [I'll let dan comment on the postfix policy]
> >>>
> >>>> What's more, it turned out that checkmodule (policy language
> compiler) 
> >>>> is not present, so I had to install one from Fedora Core 6.
> >>> [paris@localhost ~]$ cat /etc/fedora-release 
> >>> Fedora release 7 (Moonshine)
> >>> [paris@localhost ~]$ rpm -qf `which checkmodule`
> >>> checkpolicy-2.0.3-1.fc7
> >>> [paris@localhost ~]$ rpm -ql checkpolicy
> >>> /usr/bin/checkmodule
> >>> /usr/bin/checkpolicy
> >>> /usr/share/man/man8/checkmodule.8.gz
> >>> /usr/share/man/man8/checkpolicy.8.gz
> >>> [paris@localhost ~]$
> >>>
> >>> Seems to be there for me.....
> >>>
> >>> -Eric
> >>>
> >>>
> > --
> > fedora-selinux-list mailing list
> > fedora-selinux-list(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>  
>   
-- 
     "Serce medrcow jest w domu zaloby,
      a serce glupcow w domu wesela."     (Koh 7:4)

[piotreek]

Stanisław T. Findeisen pisze:
>  Hello
>
>  Hopefully you Fedora/SELinux developers already know that Postfix does 
>  not work correctly by default in Fedora Core 7?
>
>          audit(1189079035.093:14): avc:  denied  { append } for 
>  pid=2573 comm="local" name="stf" dev=sda1 ino=5881977 
>  scontext=system_u:system_r:postfix_local_t:s0 
>  tcontext=root:object_r:mail_spool_t:s0 tclass=file
>
>  This used to happen to me when I tried (as an ordinary user) to send 
>  email to myself. The file that Postfix was trying to append to was my 
>  own mail file (/var/spool/mail/stf).
>
>  I had to add this rule:
>
>          allow postfix_local_t mail_spool_t:file append;
>
>  What's more, it turned out that checkmodule (policy language compiler) 
>  is not present, so I had to install one from Fedora Core 6.
>  
Yep i can confrim it. It is broken from last postfix update i think.