<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> John Dennis wrote: <blockquote cite="mid:475174FA.4020503@redhat.com" type="cite"> <blockquote type="cite">There are others, but selinux should only log the AVCs in Permissive. Right? But the selinux system is actually doing denials. </blockquote> Just for clarification, setroubleshoot will still report a denial in permissive mode because it is logged as a denial by the audit system, however the action should still be permitted. </blockquote> I am aware of that. The problem is the action IS being denied even in Permissive mode. <blockquote cite="mid:475174FA.4020503@redhat.com" type="cite"> There is an open bug report requesting the text in the setroubleshoot message to be modified when the system is in permissive mode to say "SELinux would have denied" instead of denied. We're going to be fixing that, it's not quite as trivial as it seems because all the messages have been translated into other languages so you can't just do a simple string substitution and retain correct grammar in another language, but we will be fixing this one way or another. In theory if you're spam filtering is not working it shouldn't be because SELinux is actually denying anything because you're in permissive mode. I would first look elsewhere. I'm not saying it's impossible it's SELinux, but because you're in permissive mode it's very unlikely. </blockquote> Again, I truly believe it is selinux. For example, clamd tries to open a socket in /var/spool/amavisd. On my Fedora 7 system I get: <blockquote>root@gei ~]# l -Z /var/spool/amavisd/ drwx------ amavis amavis system_u:object_r:amavis_spool_t ./ drwxr-xr-x root root system_u:object_r:var_spool_t ../ srwxr-x--- amavis amavis system_u:object_r:amavis_var_run_t amavisd.sock= srwxrwxrwx amavis amavis system_u:object_r:clamd_var_run_t clamd.sock= drwx------ amavis amavis system_u:object_r:amavis_spool_t db/ drwx------ amavis amavis system_u:object_r:amavis_spool_t quarantine/ drwxr-x--- amavis amavis system_u:object_r:amavis_spool_t .razor/ drwx------ amavis amavis system_u:object_r:amavis_spool_t .spamassassin/ drwx------ amavis amavis system_u:object_r:amavis_spool_t tmp/ [root@gei ~]# uname -a Linux gei 2.6.23.1-21.fc7 #1 SMP Thu Nov 1 21:09:24 EDT 2007 i686 i686 i386 GNU/Linux [root@gei ~]# getenforce Enforcing [root@gei ~]# </blockquote> On the Fedora 8 system, I get: <blockquote>[root@joe ~]# getenforce Permissive [root@joe ~]# l -Z /var/spool/amavisd/ drwx------ amavis amavis system_u:object_r:amavis_spool_t ./ drwxr-xr-x root root system_u:object_r:var_spool_t ../ srwxr-x--- amavis amavis system_u:object_r:amavis_var_run_t amavisd.sock= drwx------ amavis amavis system_u:object_r:amavis_spool_t db/ drwx------ amavis amavis system_u:object_r:amavis_spool_t quarantine/ drwxr-x--- amavis amavis system_u:object_r:amavis_spool_t .razor/ drwx------ amavis amavis system_u:object_r:amavis_spool_t .spamassassin/ drwx------ amavis amavis system_u:object_r:amavis_spool_t tmp/ [root@joe ~]# uname -a Linux joe 2.6.23.1-49.fc8 #1 SMP Thu Nov 8 21:41:26 EST 2007 i686 i686 i386 GNU/Linux </blockquote> Notice that there is no socket created by clamd even in permissive mode. The following is from the maillog: <blockquote>Dec 1 11:49:45 joe postfix/smtp[8576]: 2523B38687C: to=<a class="moz-txt-link-rfc2396E" href="mailto:root@grifent.com"><root@grifent.com></a>, orig_to=<root>, relay=127.0.0.1[127.0.0.1]:10024, conn_use=2, delay=34207, delays=34175/23/0/9, dsn=4.5.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 451-4.5.0 Error in processing, id=08570-02-2, virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamd av-scanner FAILED: CODE(0x80de630) Too many retries to talk to /var/spool/amavisd/clamd.sock (Can't connect to UNIX socket /var/spool/amavisd/clamd.sock: No such file or directory) at (eval 55) line 310. at (eval 55) line 511.; ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan unexpected exit 50, output="LibClamAV Error: cli_loaddb(): No supported database files found in /var/lib/clamav/ 451-4.5.0 daily.inc 451 4.5.0 ERROR: Not supported data format" at (eval 55) line 511. (in reply to end of DATA command)) </blockquote> Notice it cannot connect to the socket because it does not exist. That confirms that the creation of the socket is being denied in my opinion. That is why I didn't bother with the rest of the AVCs yet, since I probably don't have them all without being able to successfully run in Permissive mode to collect them for startup and shutdown. Regards, John </body> </html>