procmail is not allowed to talk to spamassassin

[Nicolas Mailhot]

Hi,

Looking at audit logs I see several :

type=AVC msg=audit(1130513065.226:40): avc:  denied  { execute } for
pid=2935 comm="procmail" name="spamc" dev=dm-0 ino=3349141
scontext=system_u:system_r:postfix_local_t:s0
tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file

Shouldn't procmail be allowed to talk to spamassassin ? it's a common
enough usage pattern.

(system is up-to-date rawhide, selinux-policy-targeted-1.27.2-8)

Regards,

-- 
Nicolas Mailhot

[Daniel J Walsh]

Nicolas Mailhot wrote:
>  Hi,
>
>  Looking at audit logs I see several :
>
>  type=AVC msg=audit(1130513065.226:40): avc:  denied  { execute } for
>  pid=2935 comm="procmail" name="spamc" dev=dm-0 ino=3349141
>  scontext=system_u:system_r:postfix_local_t:s0
>  tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file
>
>  Shouldn't procmail be allowed to talk to spamassassin ? it's a common
>  enough usage pattern.
>
>  (system is up-to-date rawhide, selinux-policy-targeted-1.27.2-8)
>
>  Regards,
>     
If you add

can_exec(postfix_local_t, spamc_exec_t)

does that fix the problem?

And if you don't know how to do this,
try

chcon -t bin_t /usr/bin/spamassassin

And tell me if that fixes the problem
>    
>  ------------------------------------------------------------------------
>
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 

--

[Nicolas Mailhot]

Le vendredi 28 octobre 2005 à 11:47 -0400, Daniel J Walsh a écrit :

>  If you add
>  
>  can_exec(postfix_local_t, spamc_exec_t)
>  
>  does that fix the problem? 
Don't know how to so this one

>  And if you don't know how to do this,
>  try
>  
>  chcon -t bin_t /usr/bin/spamassassin 
This one does not work (need to replace spamassassin by spamc perhaps ?)

>  And tell me if that fixes the problem 
I can try a local fix, but I'd rather have it fixed in the default
policy, as local fixes tend to bite you when you move to another system
with vendor defaults

Regards,

-- 
Nicolas Mailhot

[Nicolas Mailhot]

Also I've just found another postfix selinux problem - do you want it on
the list or in bugzilla ?

Basically postdrop needs to be able to resolve names :

type=AVC msg=audit(1130515276.883:135): avc:  denied  { udp_send } for
pid=3351 comm="postdrop" saddr=127.0.0.1 src=32851 daddr=127.0.0.1
dest=53 netif=lo scontext=system_u:system_r:postfix_postdrop_t:s0
tcontext=system_u:object_r:netif_t:s0 tclass=netif

Oct 28 16:01:16 rousalka postfix/postdrop[3351]: fatal: config variable
inet_interfaces: host not found: rousalka.dyndns.org
Oct 28 18:01:17 rousalka postfix/sendmail[3350]: warning: premature
end-of-input on /usr/sbin/postdrop -r while reading input attribute name
Oct 28 18:01:17 rousalka postfix/sendmail[3350]: warning: command
"/usr/sbin/postdrop -r" exited with status 1
Oct 28 18:01:17 rousalka postfix/sendmail[3350]: fatal:
nicolas.mailhot(a)laposte.net(48): unable to execute /usr/sbin/postdrop
-r: Success


-- 
Nicolas Mailhot

[Daniel J Walsh]

Nicolas Mailhot wrote:
>  Le vendredi 28 octobre 2005 à 11:47 -0400, Daniel J Walsh a écrit :
>
>    
> > If you add
> >
> > can_exec(postfix_local_t, spamc_exec_t)
> >
> > does that fix the problem?
> >     
>
>  Don't know how to so this one
>
>    
> > And if you don't know how to do this,
> > try
> >
> > chcon -t bin_t /usr/bin/spamassassin
> >     
>
>  This one does not work (need to replace spamassassin by spamc perhaps ?)
>
>     
Yes, sorry about that,  I will put out policy to fix it, so this is only 
a change to see if my
fix would fix your problem. 

If the machine is in enforcing mode

setenforce 0

Then run this command to allow spam to execute spamc

chcon -t bin_t /usr/bin/spamc

Run your test,  See if there are additional AVC messages

Then run
restorecon /usr/bin/spamc
setenforc 1

And you will be back to your current state.  I will then apply fixes to the AVC messages
you generate in the next policy package.

> > And tell me if that fixes the problem
> >     
>
>  I can try a local fix, but I'd rather have it fixed in the default
>  policy, as local fixes tend to bite you when you move to another system
>  with vendor defaults
>
>  Regards,
>
>     

--

[Nicolas Mailhot]

Le vendredi 28 octobre 2005 à 13:46 -0400, Daniel J Walsh a écrit :

>  Yes, sorry about that,  I will put out policy to fix it, so this is
> only 
>  a change to see if my
>  fix would fix your problem. 
>  
>  If the machine is in enforcing mode 
I tested it several times (checking restorecon restored blocking) and it
seems to work.

Want to work on the postfix postdrop problem now ? I only get it when a
mail is queued by squirrelmail (using the sendmail command - SM does not
grok SMTPS yes, or I'd make it queue mail on the submission port like
evo)

Regards,

-- 
Nicolas Mailhot

[Daniel J Walsh]

Nicolas Mailhot wrote:
>  Le vendredi 28 octobre 2005 à 13:46 -0400, Daniel J Walsh a écrit :
>
>    
> > Yes, sorry about that,  I will put out policy to fix it, so this is only 
> > a change to see if my
> > fix would fix your problem. 
> >
> > If the machine is in enforcing mode
> >     
>
>  I tested it several times (checking restorecon restored blocking) and it
>  seems to work.
>
>  Want to work on the postfix postdrop problem now ? I only get it when a
>  mail is queued by squirrelmail (using the sendmail command - SM does not
>  grok SMTPS yes, or I'd make it queue mail on the submission port like
>  evo)
>
>  Regards,
>
>     
Updated policy on ftp://people.redhat.com/dwalsh/SELinux/Fedora/

Should fix both problems.


--

[Nicolas Mailhot]

Le vendredi 28 octobre 2005 à 16:21 -0400, Daniel J Walsh a écrit :
>   
>  Updated policy on ftp://people.redhat.com/dwalsh/SELinux/Fedora/
>  
>  Should fix both problems. 
Thanks, that was quick. However :



1. the avahi changes need more cooking :

rpm -Uvh selinux-policy-targeted-1.27.2-9.noarch.rpm
Préparation...              ###########################################
[100%]
   1:selinux-policy-targeted###########################################
[100%]
/etc/selinux/targeted/contexts/files/file_contexts:  line 776 has
invalid
context system_u:object_r:avahi_exec_t:s0:s0
/etc/selinux/targeted/contexts/files/file_contexts:  line 777 has
invalid
context system_u:object_r:avahi_exec_t:s0:s0
/etc/selinux/targeted/contexts/files/file_contexts:  line 778 has
invalid
context system_u:object_r:avahi_var_run_t:s0:s0
/var/lib is already defined in
/etc/selinux/targeted/contexts/files/file_contexts,
/usr/sbin/genhomedircon will not create a new context.



2. procmail still has trouble invoquing spamc

type=AVC msg=audit(1130531640.621:489): avc:  denied  { execute } for
pid=6118 comm="procmail" name="spamc" dev=dm-0 ino=3349141
scontext=system_u:system_r:postfix_local_t:s0
tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1130531640.621:489): arch=c000003e syscall=59
success=no exit=-13 a0=51c1a1 a1=51c140 a2=51bf90 a3=51c1a1 items=1
pid=6118 auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500
egid=500 sgid=500 fsgid=500 comm="procmail" exe="/usr/bin/procmail"
type=CWD msg=audit(1130531640.621:489):  cwd="/home/nim/.maildir"
type=PATH msg=audit(1130531640.621:489): item=0 name="/usr/bin/spamc"
flags=101  inode=3349141 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00
type=AVC msg=audit(1130531640.625:490): avc:  denied  { getattr } for
pid=6118 comm="sh" name="spamc" dev=dm-0 ino=3349141
scontext=system_u:system_r:postfix_local_t:s0
tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1130531640.625:490): arch=c000003e syscall=4
success=no exit=-13 a0=6bf780 a1=7fffff877bf0 a2=7fffff877bf0 a3=2
items=1 pid=6118 auid=4294967295 uid=500 gid=500 euid=500 suid=500
fsuid=500 egid=500 sgid=500 fsgid=500 comm="sh" exe="/bin/bash"
type=AVC_PATH msg=audit(1130531640.625:490):  path="/usr/bin/spamc"
type=CWD msg=audit(1130531640.625:490):  cwd="/home/nim/.maildir"
type=PATH msg=audit(1130531640.625:490): item=0 name="/usr/bin/spamc"
flags=1  inode=3349141 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00

3. But squirrelmail now works -> the postfix postdrop problem is fixed.
Thank you !

(I'm running with a tail on /var/log/audit/audit.log in a term now)

Regards,

-- 
Nicolas Mailhot

[Nicolas Mailhot]

And I've just noticed saslauthd is being denied setuid, though it does
not seem to cause any failure anywhere (no problems, nor errors in other
maillog or messages)


type=USER_ACCT msg=audit(1130532067.754:516): user pid=6257 uid=0
auid=4294967295 msg='PAM: accounting acct=nim :
exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?,
terminal=dovecot res=success)'
type=AVC msg=audit(1130532220.600:517): avc:  denied  { setuid } for
pid=6271 comm="saslauthd" capability=7
scontext=system_u:system_r:saslauthd_t:s0
tcontext=system_u:system_r:saslauthd_t:s0 tclass=capability
type=SYSCALL msg=audit(1130532220.600:517): arch=c000003e syscall=105
success=yes exit=0 a0=0 a1=51d160 a2=315e2346f0 a3=515e20 items=0
pid=6271 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 comm="saslauthd" exe="/usr/sbin/saslauthd"
type=USER_AUTH msg=audit(1130532220.608:518): user pid=2160 uid=0
auid=4294967295 msg='PAM: authentication acct=nim :
exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
type=AVC msg=audit(1130532220.612:519): avc:  denied  { setuid } for
pid=6272 comm="saslauthd" capability=7
scontext=system_u:system_r:saslauthd_t:s0
tcontext=system_u:system_r:saslauthd_t:s0 tclass=capability
type=SYSCALL msg=audit(1130532220.612:519): arch=c000003e syscall=105
success=yes exit=0 a0=0 a1=51d380 a2=315e2346f0 a3=51d2f0 items=0
pid=6272 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 comm="saslauthd" exe="/usr/sbin/saslauthd"
type=USER_ACCT msg=audit(1130532220.616:520): user pid=2160 uid=0
auid=4294967295 msg='PAM: accounting acct=nim :
exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
type=USER_AUTH msg=audit(1130532234.605:521): user pid=6285 uid=0
auid=4294967295 msg='PAM: authentication acct=nim :
exe="/usr/libexec/dovecot/dovecot-auth" (hostname=?, addr=?,
terminal=dovecot res=success)'


-- 
Nicolas Mailhot