SELinux warning about sendmail

[Andras Simon]

On 7/13/09, Daniel J Walsh <dwalsh at redhat.com> wrote:
> On 07/10/2009 06:09 PM, Andras Simon wrote:
>> Sometimes I see the warning:
>>
>> SELinux is preventing the sendmail from using potentially mislabeled files
>> (/root).
>>
>> sendmail is not installed, but according to sealert, this warning is
>> really about ssmtp.
>> Of course I'm not trying to mail any file from /root, in fact, I don't
>> mail anything. Any idea what might be going on?
>>
>> Andras
>>
> What is the AVC.  It might be just doing a getattr of /root which could
> trigger an AVC.
>
> When an app starts with it's homedir set to /root, it will getattr on the
> $HOME, which can cause this AVC.  Usually these are dontaudited.  So I would
> need to see the AVC to understand what it is complaining about.
>
> grep avc /var/log/audit/audit.log


type=AVC msg=audit(1247515885.083:4523): avc:  denied  { read } for
pid=31783 comm="0logwatch" path="/root" dev=sda3 ino=90113
scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023
tcontext=system_u:object_r:admin_home_t:s0 tclass=dir
type=AVC msg=audit(1247515945.140:4524): avc:  denied  { read } for
pid=32123 comm="sendmail" path="/root" dev=sda3 ino=90113
scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023
tcontext=system_u:object_r:admin_home_t:s0 tclass=dir

Thanks for looking at it!

Andras