dovecot denials

[Vadym Chepkov]

On Jul 24, 2012, at 9:47 AM, Daniel J Walsh wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 07/24/2012 09:44 AM, Vadym Chepkov wrote:
>> 
>> On Jul 24, 2012, at 9:37 AM, Daniel J Walsh wrote:
>> 
>>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>>> 
>>> On 07/24/2012 06:54 AM, Vadym Chepkov wrote:
>>>> Hi,
>>>> 
>>>> man dovecot_selinux doesn't show any booleans and yet I get the
>>>> following AVC, which in my opinion should be allowed:
>>>> 
>>>> ---- time->Mon Jul 23 00:10:03 2012 type=SYSCALL 
>>>> msg=audit(1343002203.689:153237): arch=40000003 syscall=33 success=yes 
>>>> exit=0 a0=8a472c0 a1=2 a2=bb2d84 a3=8a73418 items=0 ppid=1265
>>>> pid=22329 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505
>>>> egid=505 sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap" 
>>>> exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0 
>>>> key=(null) type=AVC msg=audit(1343002203.689:153237): avc:  denied  {
>>>> write } for  pid=22329 comm="imap" name="cur" dev=xvdb1 ino=1045676 
>>>> scontext=system_u:system_r:dovecot_t:s0 
>>>> tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir ----
>>>> time->Mon Jul 23 00:10:03 2012 type=SYSCALL
>>>> msg=audit(1343002203.689:153238): arch=40000003 syscall=5 success=yes
>>>> exit=10 a0=8a8dc90 a1=8002 a2=0 a3=bfe7f998 items=0 ppid=1265 pid=22329
>>>> auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505
>>>> sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap"
>>>> exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0
>>>> key=(null) type=AVC msg=audit(1343002203.689:153238): avc:  denied  {
>>>> open } for  pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1
>>>> ino=1046322 scontext=system_u:system_r:dovecot_t:s0 
>>>> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file type=AVC 
>>>> msg=audit(1343002203.689:153238): avc:  denied  { read write } for 
>>>> pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322 
>>>> scontext=system_u:system_r:dovecot_t:s0 
>>>> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file ----
>>>> 
>>>> selinux-policy-targeted-3.7.19-155.el6_3.noarch
>>>> 
>>>> Have I missed something?
>>>> 
>>>> Thanks, Vadym
>>>> 
>>>> 
>>>> 
>>>> -- selinux mailing list selinux at lists.fedoraproject.org 
>>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>> 
>>> Please open a bugzilla. Since this is allowed in Fedora it will likely
>>> be allowed in an Update.
>> 
>> 
>> It looks like somebody already did, should have checked bugzilla first,
>> sorry.
>> 
>> https://bugzilla.redhat.com/show_bug.cgi?id=836241
>> 
>> Thanks, Vadym
>> 
>> 
> 
> Yup, Miroslav seems to have beat me to it with a fix also.  Try to packages on
> people.redhat.com/dwalsh/SELinux/RHEL6
> 



It seems dovecot is not the only victim though:

time->Mon Jul 23 11:32:21 2012
type=SYSCALL msg=audit(1343043141.734:159344): arch=40000003 syscall=5 success=yes exit=4 a0=8a04d98 a1=80c1 a2=1b7 a3=1b7 items=0 ppid=30970 pid=30974 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=12 fsgid=505 tty=(none) ses=4294967295 comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1343043141.734:159344): avc:  denied  { write open } for  pid=30974 comm="procmail" name="1343043141.30974_0.vps2" dev=xvdb1 ino=1046397 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file
type=AVC msg=audit(1343043141.734:159344): avc:  denied  { create } for  pid=30974 comm="procmail" name="1343043141.30974_0.vps2" scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file
type=AVC msg=audit(1343043141.734:159344): avc:  denied  { add_name } for  pid=30974 comm="procmail" name="1343043141.30974_0.vps2" scontext=system_u:system_r:procmail_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir
type=AVC msg=audit(1343043141.734:159344): avc:  denied  { write } for  pid=30974 comm="procmail" name="tmp" dev=xvdb1 ino=1045675 scontext=system_u:system_r:procmail_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir
----
time->Mon Jul 23 11:32:21 2012
type=SYSCALL msg=audit(1343043141.735:159345): arch=40000003 syscall=9 success=yes exit=0 a0=8a04d98 a1=8a055a0 a2=8a055a0 a3=8a055c3 items=0 ppid=30970 pid=30974 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=12 fsgid=505 tty=(none) ses=4294967295 comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1343043141.735:159345): avc:  denied  { link } for  pid=30974 comm="procmail" name="1343043141.30974_0.vps2" dev=xvdb1 ino=1046397 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file
----
time->Mon Jul 23 11:32:21 2012
type=SYSCALL msg=audit(1343043141.736:159346): arch=40000003 syscall=10 success=yes exit=0 a0=8a04d98 a1=8a055a0 a2=0 a3=8a055c3 items=0 ppid=30970 pid=30974 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=12 fsgid=505 tty=(none) ses=4294967295 comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1343043141.736:159346): avc:  denied  { unlink } for  pid=30974 comm="procmail" name="1343043141.30974_0.vps2" dev=xvdb1 ino=1046397 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file
type=AVC msg=audit(1343043141.736:159346): avc:  denied  { remove_name } for  pid=30974 comm="procmail" name="1343043141.30974_0.vps2" dev=xvdb1 ino=1046397 scontext=system_u:system_r:procmail_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir
----


I will try to see if this fixes the problem too.

Thanks,
Vadym