binary executes in an SELinux type other than its label
"courierlogger" is labeled "courier_exec_t" in the filesystem, but
appears to execute under "system_mail_t". I think the former type is
being treated as an alias for the latter, but I don't remember where I'd
look for information on that.
The problem is that when upgrading the courier-authlib package, a
preuninstall script runs "authdaemond stop", which in turn uses
courierlogger to signal the running process to exit. The command hangs,
while courierlogger tries to send the signal (in a loop) and is denied
by SELinux policy.
$ ls -lZ /usr/sbin/courierlogger
-rwxr-xr-x. daemon daemon system_u:object_r:courier_exec_t:s0
/usr/sbin/courierlogger*
This is the AVC that is logged repeatedly while courierlogger is trying
to stop authdaemond.
type=AVC msg=audit(1436135786.396:23625): avc: denied { sigkill } for
pid=4827 comm="courierlogger"
scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023
tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process