FC4, selinux, cyrus-imapd, saslauthd

[Harry Hoffman]

Hi All,

Running FC4 with targeted policy and getting AVC messages when cyrus-imapd
tries to connect to the saslauthd socket. Here are the pertinent msgs:

type=AVC msg=audit(1122586257.404:286451): avc:  denied  { search } for
pid=2727 comm="imapd" name="saslauthd" dev=dm-3 ino=157128
scontext=root:system_r:cyrus_t
tcontext=system_u:object_r:saslauthd_var_run_t tclass=dir
type=SYSCALL msg=audit(1122586257.404:286451): arch=40000003 syscall=102
success=no exit=-13 a0=3 a1=bf8b13d0 a2=804228 a3=bf8b1437 items=1
pid=2727 auid=0 uid=76 gid=12 euid=76 suid=76 fsuid=76 egid=12 sgid=12
fsgid=12 comm="imapd" exe="/usr/lib/cyrus-imapd/imapd"
type=SOCKADDR msg=audit(1122586257.404:286451):
saddr=01002F7661722F72756E2F7361736C61757468642F6D75780000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Thanks,
Harry

[Steve G]

Hi,

I'm working on some documentation for the audit system, but I wanted to use this
as an example to show people something until I get docs finshed.
> type=AVC msg=audit(1122586257.404:286451): avc:  denied  { search }

If you take the number after the ':' in the serial number and use ausearch, you
can make this more understandable. Try:

ausearch -i -a 286451

See if that makes it easier to understand.

-Steve

____________________________________________________
Start your day with Yahoo! - make it your home page 
http://www.yahoo.com/r/hs