postfix, procmail and SELinux - No Go

[Marc Schwartz]

On Thu, 2006-06-29 at 08:29 +0100, Paul Howarth wrote:
> On Wed, 2006-06-28 at 22:15 -0500, Marc Schwartz wrote:
> > On Wed, 2006-06-28 at 23:13 +0100, Paul Howarth wrote:
> > > > > 
> > > > > That might be dontaudit-able. Is /var/lib/clamav any user's home
> > > > > directory?
> > > > 
> > > > The /var/lib/clamav tree appears to be owned by 'clamav', both user and
> > > > group:
> > > > 
> > > > $ ls -l /var/lib
> > > > total 264
> > > > ...
> > > > drwxr-xr-x  2 clamav    clamav   4096 Jun 28 11:00 clamav
> > > > ...
> > > > 
> > > >  ls -l /var/lib/clamav
> > > > total 8832
> > > > -rw-r--r-- 1 clamav clamav    4050 Jun 28 11:01 clamav-4d6166b710f63075
> > > > -rw-r--r-- 1 clamav clamav 3640966 Jun  9 16:49 clamav-651c96be267fc93e
> > > > -rw-r--r-- 1 clamav clamav  380351 Jun 28 08:00 daily.cvd
> > > > -rw-r--r-- 1 clamav clamav 4978654 Jun  9 18:00 main.cvd
> > > > 
> > > > 
> > > > $ cat /etc/passwd | grep clamav
> > > > clamav:x:100:101:Clamav database update user:/var/lib/clamav:/sbin/nologin
> > > > 
> > > > 
> > > > $ cat /etc/group | grep clamav
> > > > clamav:x:101:
> > > 
> > > The search in /var/lib/clamav is probably a result of something running
> > > as that user, perhaps procmail. Does the clamav user get any mail?
> > 
> > Paul,
> > 
> > Good call.  Yes indeed.
> > 
> > It would appear that clamav (the user) gets mail when there are problems
> > with the hourly database updates. For example, if there are DNS problems
> > or other issues with server access.  I do see these coming from the root
> > account, which then get forwarded to my user account via the postfix
> > mapping. I had not paid attention, until now, regarding the multiple
> > e-mail addresses in the To: field.
> > 
> > After doing some searching, it turns out that this is configured
> > in /etc/crond./clamav-update.
> > 
> > In that file, mail is targeted (by default) to go to root, postmaster,
> > webmaster and clamav. Now that I have looked at the content
> > of /var/spool/mail/clamav, I do note that the mail is indeed sent to the
> > aforementioned users.
> > 
> > Of course, postmaster and webmaster do not exist on my system as users.
> > 
> > Also, in the file is the following:
> > 
> > ## It is ok to execute it as root; freshclam drops privileges and becomes
> > ## user 'clamav' as soon as possible
> > 0  */3 * * * root /usr/share/clamav/freshclam-sleep
> > 
> > >From other sources, it would appear that the freshclam programs, even if
> > started as root, will setuid to clamav. This is configured
> > in /etc/freshclam.conf.  The default is:
> > 
> > # By default when started freshclam drops privileges and switches to the
> > # "clamav" user. This directive allows you to change the database owner.
> > # Default: clamav (may depend on installation options)
> > #DatabaseOwner clamav
> > 
> > 
> > I could adjust the e-mail targets or other settings if you need me to.
> 
> I think the email targets are OK; you should just alias clamav,
> webmaster, and postmaster (every mail system should have a postmaster)
> to root, which in turn is aliased to you.

Paul,

I aliased clamav to root. postmaster and webmaster were already aliased
to root.

I am also now in Enforcing mode.

We should probably give this a good 24 hours to run through the various
cycles of e-mails and cron jobs.

If anything comes up in the mean time, I'll post back.

Just for reference, current policies loaded:

amavis  1.0.4
clamav  1.0.1
dcc     1.0.0
myclamav        0.1.5
mydcc   0.1.8
mypostfix       0.1.0
mypyzor 0.2.3
myspamassassin  0.1.1
procmail        0.5.4
pyzor   1.0.1
razor   1.0.0


Thanks for all the help.

Marc