postalias segfaults

[Marius Andreiana]

Hi

With selinux enabled on FC3, postalias /etc/aliases will segfault.
There are other reports on google:
http://www.google.ro/search?q=postalias%20%22segmentation%20fault%
22&ie=UTF-8&oe=UTF-8

Disabled selinux and it works.
postfix and setup rpms are both unmodified.

Thanks
-- 
Marius Andreiana
Epon Business Applications
http://www.epon.ro

[Kanwar Ranbir Sandhu]

On Tue, 2005-01-02 at 15:04 +0200, Marius Andreiana wrote:
>  With selinux enabled on FC3, postalias /etc/aliases will segfault.
I use "postalias /etc/postfix/aliases", and haven't noticed any
problems.  Actually, the aliases file used to be in /etc and even then I
didn't have any issues.

Just in case you're wondering, selinux is on and in enforcing mode.

Regards,

Ranbir
-- 
Kanwar Ranbir Sandhu
Linux Consultant
Systems Aligned Inc.
www.systemsaligned.com

[Daniel J Walsh]

Marius Andreiana wrote:

> Hi
>
> With selinux enabled on FC3, postalias /etc/aliases will segfault.
> There are other reports on google:
> http://www.google.ro/search?q=postalias%20%22segmentation%20fault%
> 22&ie=UTF-8&oe=UTF-8
>
> Disabled selinux and it works.
> postfix and setup rpms are both unmodified.
>
> Thanks
>   
>  
Are you getting any AVC messages in /var/log/messages?

Dan

[Marius Andreiana]

On Tue, 2005-02-01 at 17:23 -0500, Daniel J Walsh wrote:
>  Are you getting any AVC messages in /var/log/messages? 
Not
related to this. Just
Feb  1 14:51:56 192-168-0-199 postfix: postalias "hash:/etc/aliases"
failed

I can't tell what for is this:
Feb  1 14:41:33 192-168-0-199 kernel: audit(1107261693.771:0): avc:
denied  { read write } for  pid=15091 exe=/usr/sbin/rndc path=/dev/tty
dev=tmpfs ino=3539 scontext=root:system_r:ndc_t
tcontext=system_u:object_r:devtty_t tclass=chr_file


And this was about an warning starting httpd and
complaining /home/galuna/www doesn't exist (file permissions were ok, I
didn't check selinux restrictions)
Feb  1 14:41:37 192-168-0-199 kernel: audit(1107261697.762:0): avc:
denied  { getattr } for  pid=15124 exe=/usr/sbin/httpd
path=/home/galuna/www dev=hda2 ino=96431 scontext=root:system_r:httpd_t
tcontext=root:object_r:user_home_t tclass=dir

I disabled SELinux for now. Will try again in FC4 and debug more.
-- 
Marius Andreiana
Epon Business Applications
http://www.epon.ro

[Daniel J Walsh]

Marius Andreiana wrote:

> On Tue, 2005-02-01 at 17:23 -0500, Daniel J Walsh wrote:
>   
>
> >Are you getting any AVC messages in /var/log/messages?
> >    
> >
> Not related to this. Just
> Feb  1 14:51:56 192-168-0-199 postfix: postalias "hash:/etc/aliases"
> failed
>
> I can't tell what for is this:
> Feb  1 14:41:33 192-168-0-199 kernel: audit(1107261693.771:0): avc:
> denied  { read write } for  pid=15091 exe=/usr/sbin/rndc path=/dev/tty
> dev=tmpfs ino=3539 scontext=root:system_r:ndc_t
> tcontext=system_u:object_r:devtty_t tclass=chr_file
>
>
> And this was about an warning starting httpd and
> complaining /home/galuna/www doesn't exist (file permissions were ok, I
> didn't check selinux restrictions)
> Feb  1 14:41:37 192-168-0-199 kernel: audit(1107261697.762:0): avc:
> denied  { getattr } for  pid=15124 exe=/usr/sbin/httpd
> path=/home/galuna/www dev=hda2 ino=96431 scontext=root:system_r:httpd_t
> tcontext=root:object_r:user_home_t tclass=dir
>
> I disabled SELinux for now. Will try again in FC4 and debug more.
>   
>  
You don't need to disable SELinux, You can disable certain "domains"
if 
you do not want them protected.
If you
chcon -R -t httpd_sys_content_t /home/galuna/www
and
setsebool -P httpd_enable_homedirs 1

Your apache should work.

Could you do a
ls -l /etc/aliases*

Dan

[Marius Andreiana]

On Wed, 2005-02-02 at 09:44 -0500, Daniel J Walsh wrote:
>  Could you do a
>  ls -l /etc/aliases* 
-rw-r--r--  1 root root  1574 Oct  8 18:37 /etc/aliases
-rw-r--r--  1 root root 12288 Feb  1 15:19 /etc/aliases.db

aliases.db was written after I disabled SELinux. I don't know how it
looked before.

Thanks
-- 
Marius Andreiana
Epon Business Applications
http://www.epon.ro

[Daniel J Walsh]

Daniel J Walsh wrote:

>  Marius Andreiana wrote:
>
> > On Tue, 2005-02-01 at 17:23 -0500, Daniel J Walsh wrote:
> >  
> >
> >> Are you getting any AVC messages in /var/log/messages?
> >>   
> >
> > Not related to this. Just
> > Feb  1 14:51:56 192-168-0-199 postfix: postalias "hash:/etc/aliases"
> > failed
> >
> > I can't tell what for is this:
> > Feb  1 14:41:33 192-168-0-199 kernel: audit(1107261693.771:0): avc:
> > denied  { read write } for  pid=15091 exe=/usr/sbin/rndc path=/dev/tty
> > dev=tmpfs ino=3539 scontext=root:system_r:ndc_t
> > tcontext=system_u:object_r:devtty_t tclass=chr_file
> >
> >
> > And this was about an warning starting httpd and
> > complaining /home/galuna/www doesn't exist (file permissions were ok, I
> > didn't check selinux restrictions)
> > Feb  1 14:41:37 192-168-0-199 kernel: audit(1107261697.762:0): avc:
> > denied  { getattr } for  pid=15124 exe=/usr/sbin/httpd
> > path=/home/galuna/www dev=hda2 ino=96431 scontext=root:system_r:httpd_t
> > tcontext=root:object_r:user_home_t tclass=dir
> >
> > I disabled SELinux for now. Will try again in FC4 and debug more.
> >  
> >
>  You don't need to disable SELinux, You can disable certain "domains" 
>  if you do not want them protected.
>  If you
>  chcon -R -t httpd_sys_content_t /home/galuna/www
>  and
>  setsebool -P httpd_enable_homedirs 1
>
>  Your apache should work.
>
>  Could you do a
>  ls -l /etc/aliases* 
I meant ls -lZ /etc/aliases

>  Dan
>
>  -- 
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Marius Andreiana]

On Wed, 2005-02-02 at 12:44 -0500, Daniel J Walsh wrote:
>  I meant ls -lZ /etc/aliases 
-rw-r--r--  root     root
system_u:object_r:etc_t          /etc/aliases
-rw-r--r--  root
root                                      /etc/aliases.db

In order to get this ls I enabled SELinux again and rebooted. Tried
postalias again and it works now. Can't explain it.

-- 
Marius Andreiana
Epon Business Applications
http://www.epon.ro