Linux Archive

Linux Archive (http://www.linux-archive.org/)
-   Fedora SELinux Support (http://www.linux-archive.org/fedora-selinux-support/)
-   -   Odd problem with dovecot (http://www.linux-archive.org/fedora-selinux-support/80824-odd-problem-dovecot.html)

Chris Adams 05-02-2008 06:50 PM

Odd problem with dovecot
 
I'm trying to set up dovecot for IMAP. I'm using an external auth
program and a static userdb setting to define the home directories (all
owned by the same UID/GID). I set the whole directory tree to
mail_spool_t (thinking I'd avoid any SELinux access issues that way).

What is odd is that it fails when SELinux is in enforcing mode, but not
in permissive, BUT I don't get any errors when it fails (e.g. no
"denied" messages in the kernel or audit logs).

I've straced the daemon, and it fails at a chdir(). I know the
permissions are okay (it works when the system is in permissive mode),
so I figured it has to be related to SELinux, but I can't figure out
how.

Suggestions?
--
Chris Adams <cmadams@hiwaay.net>
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list

Daniel J Walsh 05-06-2008 05:58 PM

Odd problem with dovecot
 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chris Adams wrote:
> I'm trying to set up dovecot for IMAP. I'm using an external auth
> program and a static userdb setting to define the home directories (all
> owned by the same UID/GID). I set the whole directory tree to
> mail_spool_t (thinking I'd avoid any SELinux access issues that way).
>
> What is odd is that it fails when SELinux is in enforcing mode, but not
> in permissive, BUT I don't get any errors when it fails (e.g. no
> "denied" messages in the kernel or audit logs).
>
> I've straced the daemon, and it fails at a chdir(). I know the
> permissions are okay (it works when the system is in permissive mode),
> so I figured it has to be related to SELinux, but I can't figure out
> how.
>
> Suggestions?
semodule -DB

will turn on all dontaudit rules.

Try your test.

semodule -B

will turn rules back on.

Check for AVC messages.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkggnF0ACgkQrlYvE4MpobPbbACfVCswQcrmWo u9ukmJLwAtQQr4
TukAoNis0d5u6YyiX6TzJDCZqNxuI1lf
=HFTt
-----END PGP SIGNATURE-----

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list

Chris Adams 05-06-2008 06:15 PM

Odd problem with dovecot
 
Once upon a time, Daniel J Walsh <dwalsh@redhat.com> said:
> Chris Adams wrote:
> > What is odd is that it fails when SELinux is in enforcing mode, but not
> > in permissive, BUT I don't get any errors when it fails (e.g. no
> > "denied" messages in the kernel or audit logs).
> semodule -DB
>
> will turn on all dontaudit rules.

Sorry, I should have been more specific: this is on RHEL 5, which does
not appear to have the -D option.

However, looking at the dontaudit rules with sesearch (I wasn't aware of
either dontaudit rules or the sesearch command before), I found the
problem. The top-level directory was still default_t, and there's a
"dontaudit dovecot_t default_t : dir { ioctl read gettr lock search };"
rule.

I changed that top-level directory and all is well. Thanks.
--
Chris Adams <cmadams@hiwaay.net>
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list


All times are GMT. The time now is 11:21 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.