dovecot denials

[Vadym Chepkov]

Hi,

man dovecot_selinux doesn't show any booleans and yet I get the following AVC, which
in my opinion should be allowed:

----
time->Mon Jul 23 00:10:03 2012
type=SYSCALL msg=audit(1343002203.689:153237): arch=40000003 syscall=33 success=yes exit=0
a0=8a472c0 a1=2 a2=bb2d84 a3=8a73418 items=0 ppid=1265 pid=22329 auid=4294967295 uid=505
gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none) ses=4294967295
comm="imap" exe="/usr/libexec/dovecot/imap"
subj=system_u:system_r:dovecot_t:s0 key=(null)
type=AVC msg=audit(1343002203.689:153237): avc:  denied  { write } for  pid=22329
comm="imap" name="cur" dev=xvdb1 ino=1045676
scontext=system_u:system_r:dovecot_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0
tclass=dir
----
time->Mon Jul 23 00:10:03 2012
type=SYSCALL msg=audit(1343002203.689:153238): arch=40000003 syscall=5 success=yes exit=10
a0=8a8dc90 a1=8002 a2=0 a3=bfe7f998 items=0 ppid=1265 pid=22329 auid=4294967295 uid=505
gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none) ses=4294967295
comm="imap" exe="/usr/libexec/dovecot/imap"
subj=system_u:system_r:dovecot_t:s0 key=(null)
type=AVC msg=audit(1343002203.689:153238): avc:  denied  { open } for  pid=22329
comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322
scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0
tclass=file
type=AVC msg=audit(1343002203.689:153238): avc:  denied  { read write } for  pid=22329
comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322
scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0
tclass=file
----

selinux-policy-targeted-3.7.19-155.el6_3.noarch

Have I missed something?

Thanks,
Vadym

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/24/2012 06:54 AM, Vadym Chepkov wrote:
>  Hi,
>  
>  man dovecot_selinux doesn't show any booleans and yet I get the following
>  AVC, which in my opinion should be allowed:
>  
>  ---- time->Mon Jul 23 00:10:03 2012 type=SYSCALL
>  msg=audit(1343002203.689:153237): arch=40000003 syscall=33 success=yes
>  exit=0 a0=8a472c0 a1=2 a2=bb2d84 a3=8a73418 items=0 ppid=1265 pid=22329
>  auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505
>  sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap"
>  exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0
>  key=(null) type=AVC msg=audit(1343002203.689:153237): avc:  denied  { write
>  } for  pid=22329 comm="imap" name="cur" dev=xvdb1 ino=1045676
>  scontext=system_u:system_r:dovecot_t:s0
>  tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir ---- time->Mon
>  Jul 23 00:10:03 2012 type=SYSCALL msg=audit(1343002203.689:153238):
>  arch=40000003 syscall=5 success=yes exit=10 a0=8a8dc90 a1=8002 a2=0
>  a3=bfe7f998 items=0 ppid=1265 pid=22329 auid=4294967295 uid=505 gid=505
>  euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none)
>  ses=4294967295 comm="imap" exe="/usr/libexec/dovecot/imap"
>  subj=system_u:system_r:dovecot_t:s0 key=(null) type=AVC
>  msg=audit(1343002203.689:153238): avc:  denied  { open } for  pid=22329
>  comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322
>  scontext=system_u:system_r:dovecot_t:s0
>  tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file type=AVC
>  msg=audit(1343002203.689:153238): avc:  denied  { read write } for
>  pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322
>  scontext=system_u:system_r:dovecot_t:s0
>  tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file ----
>  
>  selinux-policy-targeted-3.7.19-155.el6_3.noarch
>  
>  Have I missed something?
>  
>  Thanks, Vadym
>  
>  
>  
>  -- selinux mailing list selinux(a)lists.fedoraproject.org 
>  https://admin.fedoraproject.org/mailman/listinfo/selinux
>   
Please open a bugzilla. Since this is allowed in Fedora it will likely be
allowed in an Update.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAlAOpQ4ACgkQrlYvE4MpobN/igCfV6b/Ogyo4OgpEKDDz1wdVqj4
> GlYAnjTFVlR8K4gOobAhWL081FVOOinz
> =Hq2P
> -----END PGP SIGNATURE-----

[Vadym Chepkov]

On Jul 24, 2012, at 9:37 AM, Daniel J Walsh wrote:

>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>  
>  On 07/24/2012 06:54 AM, Vadym Chepkov wrote:
> > Hi,
> > 
> > man dovecot_selinux doesn't show any booleans and yet I get the following
> > AVC, which in my opinion should be allowed:
> > 
> > ---- time->Mon Jul 23 00:10:03 2012 type=SYSCALL
> > msg=audit(1343002203.689:153237): arch=40000003 syscall=33 success=yes
> > exit=0 a0=8a472c0 a1=2 a2=bb2d84 a3=8a73418 items=0 ppid=1265 pid=22329
> > auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505
> > sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap"
> > exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0
> > key=(null) type=AVC msg=audit(1343002203.689:153237): avc:  denied  { write
> > } for  pid=22329 comm="imap" name="cur" dev=xvdb1 ino=1045676
> > scontext=system_u:system_r:dovecot_t:s0
> > tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir ---- time->Mon
> > Jul 23 00:10:03 2012 type=SYSCALL msg=audit(1343002203.689:153238):
> > arch=40000003 syscall=5 success=yes exit=10 a0=8a8dc90 a1=8002 a2=0
> > a3=bfe7f998 items=0 ppid=1265 pid=22329 auid=4294967295 uid=505 gid=505
> > euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none)
> > ses=4294967295 comm="imap" exe="/usr/libexec/dovecot/imap"
> > subj=system_u:system_r:dovecot_t:s0 key=(null) type=AVC
> > msg=audit(1343002203.689:153238): avc:  denied  { open } for  pid=22329
> > comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322
> > scontext=system_u:system_r:dovecot_t:s0
> > tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file type=AVC
> > msg=audit(1343002203.689:153238): avc:  denied  { read write } for
> > pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1
> ino=1046322
> > scontext=system_u:system_r:dovecot_t:s0
> > tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file ----
> > 
> > selinux-policy-targeted-3.7.19-155.el6_3.noarch
> > 
> > Have I missed something?
> > 
> > Thanks, Vadym
> > 
> > 
> > 
> > -- selinux mailing list selinux(a)lists.fedoraproject.org 
> > https://admin.fedoraproject.org/mailman/listinfo/selinux
> > 
>  Please open a bugzilla. Since this is allowed in Fedora it will likely be
>  allowed in an Update. 

It looks like somebody already did, should have checked bugzilla first, sorry.

https://bugzilla.redhat.com/show_bug.cgi?id=836241

Thanks,
Vadym

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/24/2012 09:44 AM, Vadym Chepkov wrote:
>  
>  On Jul 24, 2012, at 9:37 AM, Daniel J Walsh wrote:
>  
> > -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
> > 
> > On 07/24/2012 06:54 AM, Vadym Chepkov wrote:
> >> Hi,
> >> 
> >> man dovecot_selinux doesn't show any booleans and yet I get the
> >> following AVC, which in my opinion should be allowed:
> >> 
> >> ---- time->Mon Jul 23 00:10:03 2012 type=SYSCALL 
> >> msg=audit(1343002203.689:153237): arch=40000003 syscall=33 success=yes 
> >> exit=0 a0=8a472c0 a1=2 a2=bb2d84 a3=8a73418 items=0 ppid=1265
> >> pid=22329 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505
> >> egid=505 sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap" 
> >> exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0 
> >> key=(null) type=AVC msg=audit(1343002203.689:153237): avc:  denied  {
> >> write } for  pid=22329 comm="imap" name="cur" dev=xvdb1
> ino=1045676 
> >> scontext=system_u:system_r:dovecot_t:s0 
> >> tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir ----
> >> time->Mon Jul 23 00:10:03 2012 type=SYSCALL
> >> msg=audit(1343002203.689:153238): arch=40000003 syscall=5 success=yes
> >> exit=10 a0=8a8dc90 a1=8002 a2=0 a3=bfe7f998 items=0 ppid=1265 pid=22329
> >> auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505
> >> sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap"
> >> exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0
> >> key=(null) type=AVC msg=audit(1343002203.689:153238): avc:  denied  {
> >> open } for  pid=22329 comm="imap" name="dovecot.index.log"
> dev=xvdb1
> >> ino=1046322 scontext=system_u:system_r:dovecot_t:s0 
> >> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file type=AVC 
> >> msg=audit(1343002203.689:153238): avc:  denied  { read write } for 
> >> pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1
> ino=1046322 
> >> scontext=system_u:system_r:dovecot_t:s0 
> >> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file ----
> >> 
> >> selinux-policy-targeted-3.7.19-155.el6_3.noarch
> >> 
> >> Have I missed something?
> >> 
> >> Thanks, Vadym
> >> 
> >> 
> >> 
> >> -- selinux mailing list selinux(a)lists.fedoraproject.org 
> >> https://admin.fedoraproject.org/mailman/listinfo/selinux
> >> 
> > Please open a bugzilla. Since this is allowed in Fedora it will likely
> > be allowed in an Update.
>  
>  
>  It looks like somebody already did, should have checked bugzilla first,
>  sorry.
>  
>  https://bugzilla.redhat.com/show_bug.cgi?id=836241
>  
>  Thanks, Vadym
>  
>   
Yup, Miroslav seems to have beat me to it with a fix also.  Try to packages on
people.redhat.com/dwalsh/SELinux/RHEL6

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAlAOp2AACgkQrlYvE4MpobP0cgCfZ2WU1gzQjAjDCAmjDX0nLHut
> BokAoIiDvhOz0jyP6ZxkK0tUCS5yMs7Z
> =/yb1
> -----END PGP SIGNATURE-----

[Vadym Chepkov]

On Jul 24, 2012, at 9:47 AM, Daniel J Walsh wrote:

>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>  
>  On 07/24/2012 09:44 AM, Vadym Chepkov wrote:
> > 
> > On Jul 24, 2012, at 9:37 AM, Daniel J Walsh wrote:
> > 
> >> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
> >> 
> >> On 07/24/2012 06:54 AM, Vadym Chepkov wrote:
> >>> Hi,
> >>> 
> >>> man dovecot_selinux doesn't show any booleans and yet I get the
> >>> following AVC, which in my opinion should be allowed:
> >>> 
> >>> ---- time->Mon Jul 23 00:10:03 2012 type=SYSCALL 
> >>> msg=audit(1343002203.689:153237): arch=40000003 syscall=33 success=yes 
> >>> exit=0 a0=8a472c0 a1=2 a2=bb2d84 a3=8a73418 items=0 ppid=1265
> >>> pid=22329 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505
> >>> egid=505 sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap" 
> >>> exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0
>
> >>> key=(null) type=AVC msg=audit(1343002203.689:153237): avc:  denied  {
> >>> write } for  pid=22329 comm="imap" name="cur" dev=xvdb1
> ino=1045676 
> >>> scontext=system_u:system_r:dovecot_t:s0 
> >>> tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir ----
> >>> time->Mon Jul 23 00:10:03 2012 type=SYSCALL
> >>> msg=audit(1343002203.689:153238): arch=40000003 syscall=5 success=yes
> >>> exit=10 a0=8a8dc90 a1=8002 a2=0 a3=bfe7f998 items=0 ppid=1265 pid=22329
> >>> auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505
> >>> sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap"
> >>> exe="/usr/libexec/dovecot/imap"
> subj=system_u:system_r:dovecot_t:s0
> >>> key=(null) type=AVC msg=audit(1343002203.689:153238): avc:  denied  {
> >>> open } for  pid=22329 comm="imap"
> name="dovecot.index.log" dev=xvdb1
> >>> ino=1046322 scontext=system_u:system_r:dovecot_t:s0 
> >>> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file type=AVC 
> >>> msg=audit(1343002203.689:153238): avc:  denied  { read write } for 
> >>> pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1
> ino=1046322 
> >>> scontext=system_u:system_r:dovecot_t:s0 
> >>> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file ----
> >>> 
> >>> selinux-policy-targeted-3.7.19-155.el6_3.noarch
> >>> 
> >>> Have I missed something?
> >>> 
> >>> Thanks, Vadym
> >>> 
> >>> 
> >>> 
> >>> -- selinux mailing list selinux(a)lists.fedoraproject.org 
> >>> https://admin.fedoraproject.org/mailman/listinfo/selinux
> >>> 
> >> Please open a bugzilla. Since this is allowed in Fedora it will likely
> >> be allowed in an Update.
> > 
> > 
> > It looks like somebody already did, should have checked bugzilla first,
> > sorry.
> > 
> > https://bugzilla.redhat.com/show_bug.cgi?id=836241
> > 
> > Thanks, Vadym
> > 
> > 
>  
>  Yup, Miroslav seems to have beat me to it with a fix also.  Try to packages on
>  people.redhat.com/dwalsh/SELinux/RHEL6
>   


It seems dovecot is not the only victim though:

time->Mon Jul 23 11:32:21 2012
type=SYSCALL msg=audit(1343043141.734:159344): arch=40000003 syscall=5 success=yes exit=4
a0=8a04d98 a1=80c1 a2=1b7 a3=1b7 items=0 ppid=30970 pid=30974 auid=4294967295 uid=505
gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=12 fsgid=505 tty=(none) ses=4294967295
comm="procmail" exe="/usr/bin/procmail"
subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1343043141.734:159344): avc:  denied  { write open } for  pid=30974
comm="procmail" name="1343043141.30974_0.vps2" dev=xvdb1 ino=1046397
scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0
tclass=file
type=AVC msg=audit(1343043141.734:159344): avc:  denied  { create } for  pid=30974
comm="procmail" name="1343043141.30974_0.vps2"
scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0
tclass=file
type=AVC msg=audit(1343043141.734:159344): avc:  denied  { add_name } for  pid=30974
comm="procmail" name="1343043141.30974_0.vps2"
scontext=system_u:system_r:procmail_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0
tclass=dir
type=AVC msg=audit(1343043141.734:159344): avc:  denied  { write } for  pid=30974
comm="procmail" name="tmp" dev=xvdb1 ino=1045675
scontext=system_u:system_r:procmail_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0
tclass=dir
----
time->Mon Jul 23 11:32:21 2012
type=SYSCALL msg=audit(1343043141.735:159345): arch=40000003 syscall=9 success=yes exit=0
a0=8a04d98 a1=8a055a0 a2=8a055a0 a3=8a055c3 items=0 ppid=30970 pid=30974 auid=4294967295
uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=12 fsgid=505 tty=(none)
ses=4294967295 comm="procmail" exe="/usr/bin/procmail"
subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1343043141.735:159345): avc:  denied  { link } for  pid=30974
comm="procmail" name="1343043141.30974_0.vps2" dev=xvdb1 ino=1046397
scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0
tclass=file
----
time->Mon Jul 23 11:32:21 2012
type=SYSCALL msg=audit(1343043141.736:159346): arch=40000003 syscall=10 success=yes exit=0
a0=8a04d98 a1=8a055a0 a2=0 a3=8a055c3 items=0 ppid=30970 pid=30974 auid=4294967295 uid=505
gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=12 fsgid=505 tty=(none) ses=4294967295
comm="procmail" exe="/usr/bin/procmail"
subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1343043141.736:159346): avc:  denied  { unlink } for  pid=30974
comm="procmail" name="1343043141.30974_0.vps2" dev=xvdb1 ino=1046397
scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0
tclass=file
type=AVC msg=audit(1343043141.736:159346): avc:  denied  { remove_name } for  pid=30974
comm="procmail" name="1343043141.30974_0.vps2" dev=xvdb1 ino=1046397
scontext=system_u:system_r:procmail_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0
tclass=dir
----


I will try to see if this fixes the problem too.

Thanks,
Vadym

[Miroslav Grepl]

On 07/24/2012 10:54 AM, Vadym Chepkov wrote:
>  Hi,
>
>  man dovecot_selinux doesn't show any booleans and yet I get the following AVC, which
> in my opinion should be allowed:
>
>  ----
>  time->Mon Jul 23 00:10:03 2012
>  type=SYSCALL msg=audit(1343002203.689:153237): arch=40000003 syscall=33 success=yes
> exit=0 a0=8a472c0 a1=2 a2=bb2d84 a3=8a73418 items=0 ppid=1265 pid=22329 auid=4294967295
> uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none)
> ses=4294967295 comm="imap" exe="/usr/libexec/dovecot/imap"
> subj=system_u:system_r:dovecot_t:s0 key=(null)
>  type=AVC msg=audit(1343002203.689:153237): avc:  denied  { write } for  pid=22329
> comm="imap" name="cur" dev=xvdb1 ino=1045676
> scontext=system_u:system_r:dovecot_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0
> tclass=dir
>  ----
>  time->Mon Jul 23 00:10:03 2012
>  type=SYSCALL msg=audit(1343002203.689:153238): arch=40000003 syscall=5 success=yes
> exit=10 a0=8a8dc90 a1=8002 a2=0 a3=bfe7f998 items=0 ppid=1265 pid=22329 auid=4294967295
> uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none)
> ses=4294967295 comm="imap" exe="/usr/libexec/dovecot/imap"
> subj=system_u:system_r:dovecot_t:s0 key=(null)
>  type=AVC msg=audit(1343002203.689:153238): avc:  denied  { open } for  pid=22329
> comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322
> scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0
> tclass=file
>  type=AVC msg=audit(1343002203.689:153238): avc:  denied  { read write } for  pid=22329
> comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322
> scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0
> tclass=file
>  ----
>
>  selinux-policy-targeted-3.7.19-155.el6_3.noarch
>
>  Have I missed something?
>
>  Thanks,
>  Vadym
>
>
>
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux 
Try the latest RHEL6
policy from

http://people.redhat.com/dwalsh/SELinux/RHEL6/noarch/