binary executes in an SELinux type other than its label

[Gordon Messmer]

"courierlogger" is labeled "courier_exec_t" in the filesystem, but 
appears to execute under "system_mail_t".  I think the former type is 
being treated as an alias for the latter, but I don't remember where I'd 
look for information on that.

The problem is that when upgrading the courier-authlib package, a 
preuninstall script runs "authdaemond stop", which in turn uses 
courierlogger to signal the running process to exit.  The command hangs, 
while courierlogger tries to send the signal (in a loop) and is denied 
by SELinux policy.

$ ls -lZ /usr/sbin/courierlogger
-rwxr-xr-x. daemon daemon system_u:object_r:courier_exec_t:s0 
/usr/sbin/courierlogger*

This is the AVC that is logged repeatedly while courierlogger is trying 
to stop authdaemond.

type=AVC msg=audit(1436135786.396:23625): avc:  denied  { sigkill } for  
pid=4827 comm="courierlogger" 
scontext=unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023 
tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process