That's it, thanks!
-----Original Message-----
From: Paul Howarth [mailto:paul@city-fan.org]
Sent: Sat 11/3/2007 10:56 AM
To: Robert C. Auch
Cc: fedora-selinux-list(a)redhat.com
Subject: Re: selinux-policy-targeted-2.6.4-49.fc7 blocking httpd from sendmail.postfix
On Fri, 2 Nov 2007 13:58:18 -0500
"Robert C. Auch" <rauch(a)totalnetsolutions.net> wrote:
I just installed a Fedora Core 7 box, ran yum update yesterday, and
installed php5 and apache 2.2.6. SELinux is in Enforcing mode, and
is blocking PHP's mail() function from sending:
Nov 2 11:05:41 webserver setroubleshoot: SELinux is preventing
the sh from using potentially mislabeled files sendmail.postfix
(sendmail_exec_t). For complete SELinux messages. run sealert -l
c9001c48-5d48-4b7c-9fd7-8400544daa8f
sealert says:
Source Context user_u:system_r:httpd_t
Target Context system_u:object_r:sendmail_exec_t
Target Objects /usr/sbin/sendmail.postfix [ file ]
Affected RPM Packages postfix-2.4.3-2.fc7 [target]
Policy RPM selinux-policy-2.6.4-48.fc7
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name plugins.httpd_bad_labels
If I follow sealert's suggestion and "chcon -t
httpd_sys_content_t /usr/sbin/sendmail.postfix", then I get the
following (expected to me) errors in /var/log/messages on "service
postfix restart": Nov 2 13:38:25 $(server) setroubleshoot:
SELinux is preventing postfix-script (postfix_master_t) "getattr"
to /usr/sbin/sendmail.postfix (httpd_sys_content_t). For
complete SELinux messages. run sealert -l
b8bea1cd-10eb-40bc-8d5b-2031b5bceabe
According to this post:
https://www.redhat.com/archives/fedora-selinux-list/2004-December/msg0003...,
this problem has been seen before and was fixed in
selinux-policy-targeted-1.19.8-1. Has that fix been lost, or am I
seeing something new?
The context change is definitely the wrong thing to do here; you'll
need to change it back to system_u:object_r:sendmail_exec_t.
Make sure you have the httpd_can_sendmail and
httpd_builtin_scripting booleans set:
# setsebool -P httpd_can_sendmail 1
# setsebool -P httpd_builtin_scripting 1
Paul.