Hi Folks -
Using FC4 postfix with 'postgrey', a greylisting service that communicates via a unix socket:
# ll -Z /var/spool/postfix/postgrey/socket srw-rw-rw- postgrey nobody root:object_r:postfix_spool_t /var/spool/postfix/postgrey/socket
After recent updates:
Sep 27 09:25:17 Updated: audit-libs.i386 1.0.4-1.fc4 Sep 27 09:25:31 Updated: audit.x86_64 1.0.4-1.fc4 Sep 27 09:25:34 Updated: selinux-policy-targeted.noarch 1.27.1-2.2 Sep 27 09:25:35 Updated: audit-libs.x86_64 1.0.4-1.fc4
and a reboot, the socket is not available for postfix to open:
Sep 27 14:08:56 siamese postfix/smtpd[13486]: warning: connect to /var/spool/postfix/postgrey/socket: Permission denied Sep 27 14:08:56 siamese postfix/smtpd[13486]: warning: problem talking to server /var/spool/postfix/postgrey/socket: Permission denied
Mail is then getting kicked because of this with, eg:
Sep 27 14:08:57 siamese postfix/smtpd[13486]: NOQUEUE: reject: RCPT from hormel.redhat.com[209.132.177.30]: 450 Server configuration problem; from=fedora-list-bounces@redhat.com to=andy@warmcat.com proto=ESMTP helo=<hormel.redhat.com>
However there are no avc complaints in /var/log/messages. Turning off enforcing (of the targetted mode this is) in system-config-securitylevel enables mail to work, therefore I deduce it is to do with selinux despite the lack of complaints.
The socket is live alright as it appears (twice?) on:
# lsof -n | grep postgrey/socket postgrey 12989 postgrey 5u unix 0xffff81007995d800 77801 /var/spool/postfix/postgrey/socket postgrey 12989 postgrey 9u unix 0xffff810005ed3800 92050 /var/spool/postfix/postgrey/socket
Any advice?
-Andy
Andy Green wrote:
Sep 27 14:08:56 siamese postfix/smtpd[13486]: warning: connect to /var/spool/postfix/postgrey/socket: Permission denied
...
However there are no avc complaints in /var/log/messages. Turning off
I discover /var/log/audit/audit.log ... much neater once you know about it :-) This is the AVC message:
type=AVC msg=audit(1127827818.253:472): avc: denied { connectto } for pid=13783 comm="smtpd" name="socket" scontext=root:system_r:postfix_smtpd_t tcontext=root:system_r:initrc_t tclass=unix_stream_socket type=SYSCALL msg=audit(1127827818.253:472): arch=c000003e syscall=42 success=yes exit=0 a0=14 a1=7fffffa59ec0 a2=6e a3=7fffffa59ec2 items=1 pid=13783 auid=500 uid=89 gid=89 euid=89 suid=89 fsuid=89 egid=89 sgid=89 fsgid=89 comm="smtpd" exe="/usr/libexec/postfix/smtpd" type=AVC_PATH msg=audit(1127827818.253:472): path="/var/spool/postfix/postgrey/socket" type=SOCKADDR msg=audit(1127827818.253:472): saddr=01002F7661722F73706F6F6C2F706F73746669782F706F7374677265792F736F636B65740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 type=PATH msg=audit(1127827818.253:472): item=0 flags=1 inode=3342296 dev=fd:00 mode=0140666 ouid=95 ogid=99 rdev=00:00
-Andy
Andy Green wrote:
Andy Green wrote:
Sep 27 14:08:56 siamese postfix/smtpd[13486]: warning: connect to /var/spool/postfix/postgrey/socket: Permission denied
...
However there are no avc complaints in /var/log/messages. Turning off
I discover /var/log/audit/audit.log ... much neater once you know about it :-) This is the AVC message:
type=AVC msg=audit(1127827818.253:472): avc: denied { connectto } for pid=13783 comm="smtpd" name="socket" scontext=root:system_r:postfix_smtpd_t tcontext=root:system_r:initrc_t tclass=unix_stream_socket type=SYSCALL msg=audit(1127827818.253:472): arch=c000003e syscall=42 success=yes exit=0 a0=14 a1=7fffffa59ec0 a2=6e a3=7fffffa59ec2 items=1 pid=13783 auid=500 uid=89 gid=89 euid=89 suid=89 fsuid=89 egid=89 sgid=89 fsgid=89 comm="smtpd" exe="/usr/libexec/postfix/smtpd" type=AVC_PATH msg=audit(1127827818.253:472): path="/var/spool/postfix/postgrey/socket" type=SOCKADDR msg=audit(1127827818.253:472): saddr=01002F7661722F73706F6F6C2F706F73746669782F706F7374677265792F736F636B65740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 type=PATH msg=audit(1127827818.253:472): item=0 flags=1 inode=3342296 dev=fd:00 mode=0140666 ouid=95 ogid=99 rdev=00:00
If you install selinux-policy-targeted-sources and add this line to /etc/selinux/policy/src/targeted/domains/misc/local.te
allow postfix_smtpd_t initrc_t:unix_stream_socket connectto;
And do a
make -c /etc/selinux/targeted/src/policy load
Does that fix your problem?
-Andy
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Daniel J Walsh wrote:
If you install selinux-policy-targeted-sources and add this line to /etc/selinux/policy/src/targeted/domains/misc/local.te
allow postfix_smtpd_t initrc_t:unix_stream_socket connectto;
And do a
make -c /etc/selinux/targeted/src/policy load
Does that fix your problem?
In short... no. I used this path:
/etc/selinux/targeted/src/policy/domains/misc/local.te
and make -C, but on completion nothing was changed. I rebooted (with a gratuitous relabel thrown in) and still it was broken. Was there another obvious step I should have taken after the make -C ... load?
-Andy
Andy Green wrote:
Daniel J Walsh wrote:
If you install selinux-policy-targeted-sources and add this line to /etc/selinux/policy/src/targeted/domains/misc/local.te
allow postfix_smtpd_t initrc_t:unix_stream_socket connectto;
And do a
make -c /etc/selinux/targeted/src/policy load
Does that fix your problem?
In short... no. I used this path:
/etc/selinux/targeted/src/policy/domains/misc/local.te
and make -C, but on completion nothing was changed. I rebooted (with a gratuitous relabel thrown in) and still it was broken. Was there another obvious step I should have taken after the make -C ... load?
-Andy
No. But are you seeing any AVC messages? Try to run with setenforce 0, and see what AVC messages are generated. No need to relabel or reboot.
Dan
Daniel J Walsh wrote:
No. But are you seeing any AVC messages? Try to run with setenforce 0, and see what AVC messages are generated. No need to relabel or reboot.
I saw a notification of a new version of the targeted policy in the testing repo fly by, so I downloaded it and updated to it.
* Tue Sep 27 2005 Dan Walsh dwalsh@redhat.com 1.27.1-2.3 - Fixes for postfix, amanda, bluetooth - Merge in changes from Rawhide.
In the meanwhile my x86_64 postalias (a postfix utility) started segfaulting for no apparent reason (with or without selinux, and after reloading it from the rpm), since this is in the /etc/init.d/ script for postfix this killed postfix as a whole. strace did not show any funny business nor did -v -v. I removed the x86_64 postfix package and replaced it with the x86 postfix package. That worked fine without altering any config except returning the /etc/postfix/main.cf back to my original one. No idea what that was about.
At the end of all this I can go back to enforcing without errors or avc messages, so I guess that is 'fixed' by the new policy rpm and/or the local.te line. Thanks for the help and sorry for the unclear nature of the resolution.
-Andy
On Tuesday 27 September 2005 23:19, Andy Green andy@warmcat.com wrote:
Using FC4 postfix with 'postgrey', a greylisting service that communicates via a unix socket:
Best to install selinux-policy-strict-sources and copy postgrey.te and postgrey.fc from there. Running postgrey in it's own domain is much better than any other option.
selinux@lists.fedoraproject.org