Linux Archive

Linux Archive (http://www.linux-archive.org/)
-   Fedora SELinux Support (http://www.linux-archive.org/fedora-selinux-support/)
-   -   dovecot denials (http://www.linux-archive.org/fedora-selinux-support/686912-dovecot-denials.html)

Daniel J Walsh 07-24-2012 01:37 PM
dovecot denials
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/24/2012 06:54 AM, Vadym Chepkov wrote:
> Hi,
>
> man dovecot_selinux doesn't show any booleans and yet I get the following
> AVC, which in my opinion should be allowed:
>
> ---- time->Mon Jul 23 00:10:03 2012 type=SYSCALL
> msg=audit(1343002203.689:153237): arch=40000003 syscall=33 success=yes
> exit=0 a0=8a472c0 a1=2 a2=bb2d84 a3=8a73418 items=0 ppid=1265 pid=22329
> auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505
> sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap"
> exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0
> key=(null) type=AVC msg=audit(1343002203.689:153237): avc: denied { write
> } for pid=22329 comm="imap" name="cur" dev=xvdb1 ino=1045676
> scontext=system_u:system_r:dovecot_t:s0
> tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir ---- time->Mon
> Jul 23 00:10:03 2012 type=SYSCALL msg=audit(1343002203.689:153238):
> arch=40000003 syscall=5 success=yes exit=10 a0=8a8dc90 a1=8002 a2=0
> a3=bfe7f998 items=0 ppid=1265 pid=22329 auid=4294967295 uid=505 gid=505
> euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none)
> ses=4294967295 comm="imap" exe="/usr/libexec/dovecot/imap"
> subj=system_u:system_r:dovecot_t:s0 key=(null) type=AVC
> msg=audit(1343002203.689:153238): avc: denied { open } for pid=22329
> comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322
> scontext=system_u:system_r:dovecot_t:s0
> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file type=AVC
> msg=audit(1343002203.689:153238): avc: denied { read write } for
> pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322
> scontext=system_u:system_r:dovecot_t:s0
> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file ----
>
> selinux-policy-targeted-3.7.19-155.el6_3.noarch
>
> Have I missed something?
>
> Thanks, Vadym
>
>
>
> -- selinux mailing list selinux@lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
Please open a bugzilla. Since this is allowed in Fedora it will likely be
allowed in an Update.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAlAOpQ4ACgkQrlYvE4MpobN/igCfV6b/Ogyo4OgpEKDDz1wdVqj4
GlYAnjTFVlR8K4gOobAhWL081FVOOinz
=Hq2P
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux

Vadym Chepkov 07-24-2012 01:44 PM
dovecot denials
 
On Jul 24, 2012, at 9:37 AM, Daniel J Walsh wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 07/24/2012 06:54 AM, Vadym Chepkov wrote:
>> Hi,
>>
>> man dovecot_selinux doesn't show any booleans and yet I get the following
>> AVC, which in my opinion should be allowed:
>>
>> ---- time->Mon Jul 23 00:10:03 2012 type=SYSCALL
>> msg=audit(1343002203.689:153237): arch=40000003 syscall=33 success=yes
>> exit=0 a0=8a472c0 a1=2 a2=bb2d84 a3=8a73418 items=0 ppid=1265 pid=22329
>> auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505
>> sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap"
>> exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0
>> key=(null) type=AVC msg=audit(1343002203.689:153237): avc: denied { write
>> } for pid=22329 comm="imap" name="cur" dev=xvdb1 ino=1045676
>> scontext=system_u:system_r:dovecot_t:s0
>> tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir ---- time->Mon
>> Jul 23 00:10:03 2012 type=SYSCALL msg=audit(1343002203.689:153238):
>> arch=40000003 syscall=5 success=yes exit=10 a0=8a8dc90 a1=8002 a2=0
>> a3=bfe7f998 items=0 ppid=1265 pid=22329 auid=4294967295 uid=505 gid=505
>> euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none)
>> ses=4294967295 comm="imap" exe="/usr/libexec/dovecot/imap"
>> subj=system_u:system_r:dovecot_t:s0 key=(null) type=AVC
>> msg=audit(1343002203.689:153238): avc: denied { open } for pid=22329
>> comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322
>> scontext=system_u:system_r:dovecot_t:s0
>> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file type=AVC
>> msg=audit(1343002203.689:153238): avc: denied { read write } for
>> pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322
>> scontext=system_u:system_r:dovecot_t:s0
>> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file ----
>>
>> selinux-policy-targeted-3.7.19-155.el6_3.noarch
>>
>> Have I missed something?
>>
>> Thanks, Vadym
>>
>>
>>
>> -- selinux mailing list selinux@lists.fedoraproject.org
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>
> Please open a bugzilla. Since this is allowed in Fedora it will likely be
> allowed in an Update.


It looks like somebody already did, should have checked bugzilla first, sorry.

https://bugzilla.redhat.com/show_bug.cgi?id=836241

Thanks,
Vadym


--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux

Daniel J Walsh 07-24-2012 01:47 PM
dovecot denials
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/24/2012 09:44 AM, Vadym Chepkov wrote:
>
> On Jul 24, 2012, at 9:37 AM, Daniel J Walsh wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>>
>> On 07/24/2012 06:54 AM, Vadym Chepkov wrote:
>>> Hi,
>>>
>>> man dovecot_selinux doesn't show any booleans and yet I get the
>>> following AVC, which in my opinion should be allowed:
>>>
>>> ---- time->Mon Jul 23 00:10:03 2012 type=SYSCALL
>>> msg=audit(1343002203.689:153237): arch=40000003 syscall=33 success=yes
>>> exit=0 a0=8a472c0 a1=2 a2=bb2d84 a3=8a73418 items=0 ppid=1265
>>> pid=22329 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505
>>> egid=505 sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap"
>>> exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0
>>> key=(null) type=AVC msg=audit(1343002203.689:153237): avc: denied {
>>> write } for pid=22329 comm="imap" name="cur" dev=xvdb1 ino=1045676
>>> scontext=system_u:system_r:dovecot_t:s0
>>> tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir ----
>>> time->Mon Jul 23 00:10:03 2012 type=SYSCALL
>>> msg=audit(1343002203.689:153238): arch=40000003 syscall=5 success=yes
>>> exit=10 a0=8a8dc90 a1=8002 a2=0 a3=bfe7f998 items=0 ppid=1265 pid=22329
>>> auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505
>>> sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap"
>>> exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0
>>> key=(null) type=AVC msg=audit(1343002203.689:153238): avc: denied {
>>> open } for pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1
>>> ino=1046322 scontext=system_u:system_r:dovecot_t:s0
>>> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file type=AVC
>>> msg=audit(1343002203.689:153238): avc: denied { read write } for
>>> pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322
>>> scontext=system_u:system_r:dovecot_t:s0
>>> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file ----
>>>
>>> selinux-policy-targeted-3.7.19-155.el6_3.noarch
>>>
>>> Have I missed something?
>>>
>>> Thanks, Vadym
>>>
>>>
>>>
>>> -- selinux mailing list selinux@lists.fedoraproject.org
>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>
>> Please open a bugzilla. Since this is allowed in Fedora it will likely
>> be allowed in an Update.
>
>
> It looks like somebody already did, should have checked bugzilla first,
> sorry.
>
> https://bugzilla.redhat.com/show_bug.cgi?id=836241
>
> Thanks, Vadym
>
>

Yup, Miroslav seems to have beat me to it with a fix also. Try to packages on
people.redhat.com/dwalsh/SELinux/RHEL6

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAlAOp2AACgkQrlYvE4MpobP0cgCfZ2WU1gzQjA jDCAmjDX0nLHut
BokAoIiDvhOz0jyP6ZxkK0tUCS5yMs7Z
=/yb1
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux

Vadym Chepkov 07-24-2012 01:48 PM
dovecot denials
 
On Jul 24, 2012, at 9:47 AM, Daniel J Walsh wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 07/24/2012 09:44 AM, Vadym Chepkov wrote:
>>
>> On Jul 24, 2012, at 9:37 AM, Daniel J Walsh wrote:
>>
>>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>>>
>>> On 07/24/2012 06:54 AM, Vadym Chepkov wrote:
>>>> Hi,
>>>>
>>>> man dovecot_selinux doesn't show any booleans and yet I get the
>>>> following AVC, which in my opinion should be allowed:
>>>>
>>>> ---- time->Mon Jul 23 00:10:03 2012 type=SYSCALL
>>>> msg=audit(1343002203.689:153237): arch=40000003 syscall=33 success=yes
>>>> exit=0 a0=8a472c0 a1=2 a2=bb2d84 a3=8a73418 items=0 ppid=1265
>>>> pid=22329 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505
>>>> egid=505 sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap"
>>>> exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0
>>>> key=(null) type=AVC msg=audit(1343002203.689:153237): avc: denied {
>>>> write } for pid=22329 comm="imap" name="cur" dev=xvdb1 ino=1045676
>>>> scontext=system_u:system_r:dovecot_t:s0
>>>> tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir ----
>>>> time->Mon Jul 23 00:10:03 2012 type=SYSCALL
>>>> msg=audit(1343002203.689:153238): arch=40000003 syscall=5 success=yes
>>>> exit=10 a0=8a8dc90 a1=8002 a2=0 a3=bfe7f998 items=0 ppid=1265 pid=22329
>>>> auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505
>>>> sgid=505 fsgid=505 tty=(none) ses=4294967295 comm="imap"
>>>> exe="/usr/libexec/dovecot/imap" subj=system_u:system_r:dovecot_t:s0
>>>> key=(null) type=AVC msg=audit(1343002203.689:153238): avc: denied {
>>>> open } for pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1
>>>> ino=1046322 scontext=system_u:system_r:dovecot_t:s0
>>>> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file type=AVC
>>>> msg=audit(1343002203.689:153238): avc: denied { read write } for
>>>> pid=22329 comm="imap" name="dovecot.index.log" dev=xvdb1 ino=1046322
>>>> scontext=system_u:system_r:dovecot_t:s0
>>>> tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file ----
>>>>
>>>> selinux-policy-targeted-3.7.19-155.el6_3.noarch
>>>>
>>>> Have I missed something?
>>>>
>>>> Thanks, Vadym
>>>>
>>>>
>>>>
>>>> -- selinux mailing list selinux@lists.fedoraproject.org
>>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>>
>>> Please open a bugzilla. Since this is allowed in Fedora it will likely
>>> be allowed in an Update.
>>
>>
>> It looks like somebody already did, should have checked bugzilla first,
>> sorry.
>>
>> https://bugzilla.redhat.com/show_bug.cgi?id=836241
>>
>> Thanks, Vadym
>>
>>
>
> Yup, Miroslav seems to have beat me to it with a fix also. Try to packages on
> people.redhat.com/dwalsh/SELinux/RHEL6
>



It seems dovecot is not the only victim though:

time->Mon Jul 23 11:32:21 2012
type=SYSCALL msg=audit(1343043141.734:159344): arch=40000003 syscall=5 success=yes exit=4 a0=8a04d98 a1=80c1 a2=1b7 a3=1b7 items=0 ppid=30970 pid=30974 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=12 fsgid=505 tty=(none) ses=4294967295 comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1343043141.734:159344): avc: denied { write open } for pid=30974 comm="procmail" name="1343043141.30974_0.vps2" dev=xvdb1 ino=1046397 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file
type=AVC msg=audit(1343043141.734:159344): avc: denied { create } for pid=30974 comm="procmail" name="1343043141.30974_0.vps2" scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file
type=AVC msg=audit(1343043141.734:159344): avc: denied { add_name } for pid=30974 comm="procmail" name="1343043141.30974_0.vps2" scontext=system_u:system_r:procmail_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir
type=AVC msg=audit(1343043141.734:159344): avc: denied { write } for pid=30974 comm="procmail" name="tmp" dev=xvdb1 ino=1045675 scontext=system_u:system_r:procmail_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir
----
time->Mon Jul 23 11:32:21 2012
type=SYSCALL msg=audit(1343043141.735:159345): arch=40000003 syscall=9 success=yes exit=0 a0=8a04d98 a1=8a055a0 a2=8a055a0 a3=8a055c3 items=0 ppid=30970 pid=30974 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=12 fsgid=505 tty=(none) ses=4294967295 comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1343043141.735:159345): avc: denied { link } for pid=30974 comm="procmail" name="1343043141.30974_0.vps2" dev=xvdb1 ino=1046397 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file
----
time->Mon Jul 23 11:32:21 2012
type=SYSCALL msg=audit(1343043141.736:159346): arch=40000003 syscall=10 success=yes exit=0 a0=8a04d98 a1=8a055a0 a2=0 a3=8a055c3 items=0 ppid=30970 pid=30974 auid=4294967295 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=12 fsgid=505 tty=(none) ses=4294967295 comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1343043141.736:159346): avc: denied { unlink } for pid=30974 comm="procmail" name="1343043141.30974_0.vps2" dev=xvdb1 ino=1046397 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mail_home_rw_t:s0 tclass=file
type=AVC msg=audit(1343043141.736:159346): avc: denied { remove_name } for pid=30974 comm="procmail" name="1343043141.30974_0.vps2" dev=xvdb1 ino=1046397 scontext=system_u:system_r:procmail_t:s0 tcontext=unconfined_u:object_r:mail_home_rw_t:s0 tclass=dir
----


I will try to see if this fixes the problem too.

Thanks,
Vadym


--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux


All times are GMT. The time now is 09:06 AM.

VBulletin, Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.