selinux + mailman +postfix security problem (F14)

[Fulko Hew]

On Fedora 14, I am setting up postfix and mailman.

I had this working once, but I decided to yum erase postfix and mailman
and redo the configuration to prove I knew how to recreate it.

Turns out I don't know how to recreate a working combination
because when creating a new list I now have mailman error log that
talks about:

command failed: /usr/sbin/postalias /etc/mailman/aliases (status: 1,
Operation not permitted)

and a corresponding AVC error:

Aug 25 10:28:54 (null) (null): audit(1314282534.501:4326): avc: denied {
search } for
pid=12121 comm=postalias name=postfix ino=295074 dev=dm-0
scontext=system_u:system_r:mailman_cgi_t:s0
tcontext=system_u:object_r:postfix_etc_t:s0 tclass=dir

Suggestions?

Fulko

[Fulko Hew]

On Thu, Aug 25, 2011 at 12:20 PM, Marcos Luis Ortiz Valmaseda <
marcosluis2186(a)googlemail.com&gt; wrote:

>  Well, test it and say the response to us.
>  
So the first issue was:
SELinux is preventing /usr/sbin/postalias from search access on the
directory /etc/postfix.

It then complained (one at a time) about:
SELinux is preventing /usr/sbin/postalias from read access on the file
/etc/postfix/main.cf.
SELinux is preventing /usr/sbin/postalias from open access on the file
/etc/postfix/main.cf.
SELinux is preventing /usr/sbin/postalias from getattr access on the file
/etc/postfix/main.cf.

So I  redid 'audit2allow' over and over to get past each problem.

...I can continue to do this, or disable SELinux, but I shouldn't have to,
   something else is wrong here.  ;-(

Finally, I can now create a new mailing list.


>  2011/8/25 Fulko Hew <fulko.hew(a)gmail.com&gt;
>
> >
> >
> > On Thu, Aug 25, 2011 at 12:13 PM, Marcos Luis Ortiz Valmaseda <
> > marcosluis2186(a)googlemail.com&gt; wrote:
> >
> >> Can you provide the ls -Z of your content in /etc/mailman/aliases
> >>
> >
> >  [root@netwatch log]# ls -Z /etc/mailman/aliases
> > -rw-rw----. root mailman unconfined_u:object_r:mailman_data_t:s0
> > /etc/mailman/aliases
> >
> > A advice:, use sealert to see a more human-readable approach to analyze
> >> the SELinux logs.
> >>
> >
> > While waiting for a response from the list... I had just (discovered and)
> > done a:
> >
> > # grep postalias /var/log/audit/audit.log | audit2allow -M mypol
> > # semodule -i mypol.pp
> >
> > But I haven't tested it yet.
> >
> >
> >
> >  2011/8/25 Fulko Hew <fulko.hew(a)gmail.com&gt;
> >>
> >>> On Fedora 14, I am setting up postfix and mailman.
> >>>
> >>> I had this working once, but I decided to yum erase postfix and mailman
> >>> and redo the configuration to prove I knew how to recreate it.
> >>>
> >>> Turns out I don't know how to recreate a working combination
> >>> because when creating a new list I now have mailman error log that
> >>> talks about:
> >>>
> >>> command failed: /usr/sbin/postalias /etc/mailman/aliases (status: 1,
> >>> Operation not permitted)
> >>>
> >>> and a corresponding AVC error:
> >>>
> >>> Aug 25 10:28:54 (null) (null): audit(1314282534.501:4326): avc: denied {
> >>> search } for
> >>> pid=12121 comm=postalias name=postfix ino=295074 dev=dm-0
> >>> scontext=system_u:system_r:mailman_cgi_t:s0
> >>> tcontext=system_u:object_r:postfix_etc_t:s0 tclass=dir
> >>>
> >>> Suggestions?
> >>>
> >>> Fulko
> >>>
> >>

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/25/2011 11:52 AM, Fulko Hew wrote:
>  On Fedora 14, I am setting up postfix and mailman.
>  
>  I had this working once, but I decided to yum erase postfix and
>  mailman and redo the configuration to prove I knew how to recreate
>  it.
>  
>  Turns out I don't know how to recreate a working combination 
>  because when creating a new list I now have mailman error log that 
>  talks about:
>  
>  command failed: /usr/sbin/postalias /etc/mailman/aliases (status:
>  1, Operation not permitted)
>  
>  and a corresponding AVC error:
>  
>  Aug 25 10:28:54 (null) (null): audit(1314282534.501:4326): avc:
>  denied { search } for pid=12121 comm=postalias name=postfix
>  ino=295074 dev=dm-0 scontext=system_u:system_r:mailman_cgi_t:s0 
>  tcontext=system_u:object_r:postfix_etc_t:s0 tclass=dir
>  
>  Suggestions?
>  
>  Fulko
>  
>  
>   
restorecon -R -v /etc/mailman

Should change the label.

Should be

system_u:object_r:mailman_data_t:s0
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk5WkTMACgkQrlYvE4MpobOasgCeIdIyRBaKF3hgzcvscoad168f
> iKUAnj/kTOp9HFmYVU0452BY/yanXiyS
> =6UeM
> -----END PGP SIGNATURE-----

[Marcos Luis Ortiz Valmaseda]

Well, test it and say the response to us.


2011/8/25 Fulko Hew <fulko.hew(a)gmail.com&gt;

>  On Thu, Aug 25, 2011 at 12:13 PM, Marcos Luis Ortiz Valmaseda <
>  marcosluis2186(a)googlemail.com&gt; wrote:
>
> > Can you provide the ls -Z of your content in /etc/mailman/aliases
> >
>
>   [root@netwatch log]# ls -Z /etc/mailman/aliases
>  -rw-rw----. root mailman unconfined_u:object_r:mailman_data_t:s0
>  /etc/mailman/aliases
>
>  A advice:, use sealert to see a more human-readable approach to analyze the
> > SELinux logs.
> >
>
>  While waiting for a response from the list... I had just (discovered and)
>  done a:
>
>  # grep postalias /var/log/audit/audit.log | audit2allow -M mypol
>  # semodule -i mypol.pp
>
>  But I haven't tested it yet.
>
>
>
>  2011/8/25 Fulko Hew <fulko.hew(a)gmail.com&gt;
> >
> >> On Fedora 14, I am setting up postfix and mailman.
> >>
> >> I had this working once, but I decided to yum erase postfix and mailman
> >> and redo the configuration to prove I knew how to recreate it.
> >>
> >> Turns out I don't know how to recreate a working combination
> >> because when creating a new list I now have mailman error log that
> >> talks about:
> >>
> >> command failed: /usr/sbin/postalias /etc/mailman/aliases (status: 1,
> >> Operation not permitted)
> >>
> >> and a corresponding AVC error:
> >>
> >> Aug 25 10:28:54 (null) (null): audit(1314282534.501:4326): avc: denied {
> >> search } for
> >> pid=12121 comm=postalias name=postfix ino=295074 dev=dm-0
> >> scontext=system_u:system_r:mailman_cgi_t:s0
> >> tcontext=system_u:object_r:postfix_etc_t:s0 tclass=dir
> >>
> >> Suggestions?
> >>
> >> Fulko
> >>
> >
>
>  --
>  users mailing list
>  users(a)lists.fedoraproject.org
>  To unsubscribe or change subscription options:
>  https://admin.fedoraproject.org/mailman/listinfo/users
>  Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
>
>  

-- 
-- 
Marcos Luis Ortíz Valmaseda
 Software Engineer (UCI)
 Linux User # 418229
 http://marcosluis2186.posterous.com
 http://www.linkedin.com/in/marcosluis2186
 https://fedoraproject.org/wiki/User:Marcosluis

[Fulko Hew]

On Thu, Aug 25, 2011 at 12:13 PM, Marcos Luis Ortiz Valmaseda <
marcosluis2186(a)googlemail.com&gt; wrote:

>  Can you provide the ls -Z of your content in /etc/mailman/aliases
>  
 [root@netwatch log]# ls -Z /etc/mailman/aliases
-rw-rw----. root mailman unconfined_u:object_r:mailman_data_t:s0
/etc/mailman/aliases

A advice:, use sealert to see a more human-readable approach to analyze the
>  SELinux logs.
>  
While waiting for a response from the list... I had just (discovered and)
done a:

# grep postalias /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

But I haven't tested it yet.



2011/8/25 Fulko Hew <fulko.hew(a)gmail.com&gt;
> > On Fedora 14, I am setting up postfix and mailman.
> >
> > I had this working once, but I decided to yum erase postfix and mailman
> > and redo the configuration to prove I knew how to recreate it.
> >
> > Turns out I don't know how to recreate a working combination
> > because when creating a new list I now have mailman error log that
> > talks about:
> >
> > command failed: /usr/sbin/postalias /etc/mailman/aliases (status: 1,
> > Operation not permitted)
> >
> > and a corresponding AVC error:
> >
> > Aug 25 10:28:54 (null) (null): audit(1314282534.501:4326): avc: denied {
> > search } for
> > pid=12121 comm=postalias name=postfix ino=295074 dev=dm-0
> > scontext=system_u:system_r:mailman_cgi_t:s0
> > tcontext=system_u:object_r:postfix_etc_t:s0 tclass=dir
> >
> > Suggestions?
> >
> > Fulko
> >
>

[Marcos Luis Ortiz Valmaseda]

Can you provide the ls -Z of your content in /etc/mailman/aliases
A advice:, use sealert to see a more human-readable approach to analyze the
SELinux logs.


2011/8/25 Fulko Hew <fulko.hew(a)gmail.com&gt;

>  On Fedora 14, I am setting up postfix and mailman.
>
>  I had this working once, but I decided to yum erase postfix and mailman
>  and redo the configuration to prove I knew how to recreate it.
>
>  Turns out I don't know how to recreate a working combination
>  because when creating a new list I now have mailman error log that
>  talks about:
>
>  command failed: /usr/sbin/postalias /etc/mailman/aliases (status: 1,
>  Operation not permitted)
>
>  and a corresponding AVC error:
>
>  Aug 25 10:28:54 (null) (null): audit(1314282534.501:4326): avc: denied {
>  search } for
>  pid=12121 comm=postalias name=postfix ino=295074 dev=dm-0
>  scontext=system_u:system_r:mailman_cgi_t:s0
>  tcontext=system_u:object_r:postfix_etc_t:s0 tclass=dir
>
>  Suggestions?
>
>  Fulko
>
>
>  --
>  users mailing list
>  users(a)lists.fedoraproject.org
>  To unsubscribe or change subscription options:
>  https://admin.fedoraproject.org/mailman/listinfo/users
>  Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
>
>  

-- 
-- 
Marcos Luis Ortíz Valmaseda
 Software Engineer (UCI)
 Linux User # 418229
 http://marcosluis2186.posterous.com
 http://www.linkedin.com/in/marcosluis2186
 https://fedoraproject.org/wiki/User:Marcosluis