<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
<br>
Daniel J Walsh wrote:
<blockquote cite="mid:4AC1F34A.80000@redhat.com" type="cite">
<pre wrap="">On 09/23/2009 12:00 PM, John Griffiths wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
Daniel J Walsh wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On 09/23/2009 07:47 AM, John Griffiths wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I am using selinux-policy-targeted-3.5.13-71.fc10.noarch on Fedora 10. I am
getting these AVCs. They do not seem to inhibit functionality but still
troublesome to get the selinux alerts all the time. Are these bugs in the policy
or something that will not be addressed and I need to generate local policy?
1) SELinux is preventing postdrop (postfix_postdrop_t) "getattr" httpd_t.
Raw Audit Messages :
node=elijah.suretrak21.net type=AVC msg=audit(1253716264.867:65886): avc:
denied { getattr } for pid=30094 comm="postdrop" path="pipe:[2618550]"
dev=pipefs ino=2618550 scontext=system_u:system_r:postfix_postdrop_t:s0
tcontext=system_u:system_r:httpd_t:s0 tclass=fifo_file
node=elijah.suretrak21.net type=SYSCALL msg=audit(1253716264.867:65886):
arch=40000003 syscall=197 success=no exit=-13 a0=2 a1=bfc167c8 a2=94eff4
a3=2 items=0 ppid=30093 pid=30094 auid=4294967295 uid=48 gid=48 euid=48
suid=48 fsuid=48 egid=90 sgid=90 fsgid=90 tty=(none) ses=4294967295
comm="postdrop" exe="/usr/sbin/postdrop"
subj=system_u:system_r:postfix_postdrop_t:s0 key=(null)
</pre>
</blockquote>
<pre wrap="">This seems a little strange, is postfix being executed from apache? I would guess that postfix does not communicate with apache via fifo_file, so might be a leak.
</pre>
</blockquote>
<pre wrap="">This happens in conjunction with email being sent by Bugzilla which is of course
being served by apache.
</pre>
</blockquote>
<pre wrap=""><!---->Is mail being sent successfully? I believe this is also a leaked file descriptor.
</pre>
</blockquote>
Email is successfully sent.<br>
<blockquote cite="mid:4AC1F34A.80000@redhat.com" type="cite">
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">
<pre wrap=""> 2) SELinux is preventing sendmail (system_mail_t)
</pre>
</blockquote>
</blockquote>
</blockquote>
<pre wrap=""><!---->"read" to
</pre>
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">
<pre wrap=""> /usr/share/GeoIP/GeoIP.dat (usr_t).
Raw Audit Messages :
node=elijah.suretrak21.net type=AVC msg=audit(1253643380.763:60806): avc:
denied { read } for pid=1311 comm="sendmail"
path="/usr/share/GeoIP/GeoIP.dat" dev=dm-0 ino=663651
scontext=system_u:system_r:system_mail_t:s0
tcontext=system_u:object_r:usr_t:s0 tclass=file
node=elijah.suretrak21.net type=SYSCALL msg=audit(1253643380.763:60806):
arch=40000003 syscall=11 success=yes exit=0 a0=9ad05d0 a1=9acfd18 a2=9acfb08
a3=0 items=0 ppid=14784 pid=1311 auid=4294967295 uid=48 gid=48 euid=48
suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295
comm="sendmail" exe="/usr/sbin/sendmail.postfix"
subj=system_u:system_r:system_mail_t:s0 key=(null)
</pre>
</blockquote>
<pre wrap="">This one looks like a leak unless something is actually trying to mail /usr/share/GeoIP/GeoIP.dat
</pre>
</blockquote>
<pre wrap="">Apache has geoip_module configured, but that is the only place I have GeoIP
configured.
</pre>
</blockquote>
<pre wrap=""><!---->Well that GeoIP module is probably sending email or at least opening that file before httpd_t sends mail for another module, revealing the leak. You can add an allow rule using audit2allow, if this is probably not important data. Open a bugzilla with geoip_module to not leak the file. If you are not using the geoip_module, remove it from your apache config.
</pre>
</blockquote>
Will open bugzilla.<br>
<blockquote cite="mid:4AC1F34A.80000@redhat.com" type="cite">
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">Regards,
John Griffiths
------------------------------------------------------------------------
--
fedora-selinux-list mailing list
<a class="moz-txt-link-abbreviated" href="mailto:fedora-selinux-list@redhat.com">fedora-selinux-list@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/fedora-selinux-list">https://www.redhat.com/mailman/listinfo/fedora-selinux-list</a>
</pre>
</blockquote>
<pre wrap="">You can add custom policy to allow these by executing audit2allow -M mypol
</pre>
</blockquote>
</blockquote>
<pre wrap=""><!---->
</pre>
</blockquote>
</body>
</html>