dovecot denials

[Vadym Chepkov]

On Jul 24, 2012, at 9:37 AM, Daniel J Walsh wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 07/24/2012 06:54 AM, Vadym Chepkov wrote:
>> Hi,
>> 
>> man dovecot_selinux doesn't show any booleans and yet I get the following
>> AVC, which in my opinion should be allowed:
>> 
>> ---- time->Mon Jul 23 00:10:03 2012 type=SYSCALL
>> msg=audit(1343002203.689:153237): arch=40000003 syscall=33 success=yes
>> exit=0 a0=8a472c0 a1=2 a2=bb2d84 a3=8a73418 items=0 ppid=1265 pid=22329
>> auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505
>> sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap"
>> exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0
>> key=(null) type=AVC msg=audit(1343002203.689:153237): avc:  denied  { write
>> } for  pid=22329 comm="imap" name="cur" dev=xvdb1 ino=1045676
>> scontext=system_u:system_r:dovecot_t:s0
>> tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir ---- time->Mon
>> Jul 23 00:10:03 2012 type=SYSCALL msg=audit(1343002203.689:153238):
>> arch=40000003 syscall=5 success=yes exit=10 a0=8a8dc90 a1=8002 a2=0
>> a3=bfe7f998 items=0 ppid=1265 pid=22329 auid=4294967295 uid=505 gid=505
>> euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none)
>> ses=4294967295 comm="imap" exe="/usr/libexec/dovecot/imap"
>> subj=system_u:system_r:dovecot_t:s0 key=(null) type=AVC
>> msg=audit(1343002203.689:153238): avc:  denied  { open } for  pid=22329
>> comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322
>> scontext=system_u:system_r:dovecot_t:s0
>> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file type=AVC
>> msg=audit(1343002203.689:153238): avc:  denied  { read write } for
>> pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322
>> scontext=system_u:system_r:dovecot_t:s0
>> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file ----
>> 
>> selinux-policy-targeted-3.7.19-155.el6_3.noarch
>> 
>> Have I missed something?
>> 
>> Thanks, Vadym
>> 
>> 
>> 
>> -- selinux mailing list selinux at lists.fedoraproject.org 
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>> 
> Please open a bugzilla. Since this is allowed in Fedora it will likely be
> allowed in an Update.


It looks like somebody already did, should have checked bugzilla first, sorry.

https://bugzilla.redhat.com/show_bug.cgi?id=836241

Thanks,
Vadym