Re: selinux, sendmail, and services



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Steven Stern wrote:
On 02/26/2008 07:37 AM, Daniel J Walsh wrote:
| Steven Stern wrote:
|> For two days, I've been receiving notices from setroubleshooter about
|> sendmail and "unknown file". Today, after the pam update, I rebooted
|> and saw sendmail fail to start due to a problem with "services".
|
|> Feb 26 06:55:50 sds-desk setroubleshoot: #012 SELinux is preventing
|> the /usr/sbin/sendmail.sendmail from using potentially mislabeled files
|> (<Unknown>).#012
|
|> Feb 26 07:04:35 sds-desk setroubleshoot: #012 SELinux is preventing
|> the /usr/sbin/sendmail.sendmail from using potentially mislabeled files
|> (/etc/services).#012
|
|> I used
|
|> ~ grep sendmail /var/log/audit/audit.log | audit2allow -M sendmail
|
|> to generate a policy to fix this. Was this the right thing to do? And
|> what caused sendmail and selinux to suddenly have a problem?
|
|> sendmail.te:
|
|> module sendmail 1.0;
|
|> require {
|> ~ type initrc_tmp_t;
|> ~ type rpm_script_tmp_t;
|> ~ type system_mail_t;
|> ~ type unconfined_home_t;
|> ~ type sendmail_t;
|> ~ type unconfined_home_dir_t;
|> ~ type var_t;
|> ~ class process setrlimit;
|> ~ class dir { getattr search };
|> ~ class file { write getattr read ioctl };
|> }
|
|> #============= sendmail_t ==============
|> allow sendmail_t initrc_tmp_t:file { read write getattr ioctl };
This one seems reasonable.
|> allow sendmail_t rpm_script_tmp_t:file read;
/etc/services bad label
|> allow sendmail_t self:process setrlimit;
Never seen this before, But I guess I will add
|> allow sendmail_t unconfined_home_dir_t:dir { getattr search };
|> allow sendmail_t unconfined_home_t:file { read getattr };
These are allowed in current policy for Rawhide/Fedora 8
|> allow sendmail_t var_t:file { read write };
This will have to be special for your install. We would need policy for
webmin
|
|> #============= system_mail_t ==============
|> allow system_mail_t rpm_script_tmp_t:file read;
|
|
| I think your problem is you have a badly labeled /etc/services file.
| restorecon /etc/services
|
| vmware has a bug in there postinstall script that screws up the labeling
| of /etc/services.
|
| I am not sure of your other changes so could you please attach the
| audit.log file that you used to generate this policy.

That makes sense. I was playing with vmware server this weekend,
installed from VMWare's rpm installer.

The log is attached.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkfEH5AACgkQrlYvE4MpobO0JgCfdF3VejfQaGivM4bpzRWghMvl
0kMAoM+J7xIneV2yk0BZWQkycT4jJMRM
=s1RH
-----END PGP SIGNATURE-----

--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list



Relevant Pages

  • Re: Migrating to a newer version of FreeBSD
    ... So I hastily installed a radius server, ... > sendmail and qpopper on it. ... > cannot seem to just download newer ports and install them. ... > authentication working on that one quickly and easily. ...
    (freebsd-questions)
  • RESOLVED: Solaris 8 - Configuring sendmail relay (NoAuth inbound -> SSL outbound)
    ... If your smtp server is smtp.att.yahoo.com then the default sendmail installed with Solaris 8 will no longer be able to send mail. ... gunzip & untar BerkeleyDB.4.2; install per the README. ...
    (comp.mail.sendmail)
  • RE: Sendmail - IMAP-UW - Cyrus-SASL2 - SMTPAUTH problems
    ... Sendmail was installed with the base install and recompiled ... sets up a DAEMON port. ... creating SMTP socket ...
    (freebsd-questions)
  • Re: Mail software question.
    ... > Does sendmail support IMAP or do I have to install something on top of ... > something that advertises itself as an IMAP server is that also the MTA ... > If I install fetch mail, can I get it to place ... server for open-xchange and found that imap-uw works out of the box with ...
    (comp.unix.bsd.freebsd.misc)
  • Re: Mail software question.
    ... > Does sendmail support IMAP or do I have to install something on top of ... > something that advertises itself as an IMAP server is that also the MTA ... > If I install fetch mail, can I get it to place ... server for open-xchange and found that imap-uw works out of the box with ...
    (comp.unix.bsd.freebsd.misc)