"courierlogger" is labeled "courier_exec_t" in the filesystem, but appears to execute under "system_mail_t". I think the former type is being treated as an alias for the latter, but I don't remember where I'd look for information on that.
The problem is that when upgrading the courier-authlib package, a preuninstall script runs "authdaemond stop", which in turn uses courierlogger to signal the running process to exit. The command hangs, while courierlogger tries to send the signal (in a loop) and is denied by SELinux policy.
$ ls -lZ /usr/sbin/courierlogger -rwxr-xr-x. daemon daemon system_u:object_r:courier_exec_t:s0 /usr/sbin/courierlogger*
This is the AVC that is logged repeatedly while courierlogger is trying to stop authdaemond.
type=AVC msg=audit(1436135786.396:23625): avc: denied { sigkill } for pid=4827 comm="courierlogger" scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process
-
Gordon Messmer