postfix, procmail and SELinux - No Go

[Marc Schwartz]

On Sun, 2006-06-25 at 09:40 +0100, Paul Howarth wrote:
> On Sat, 2006-06-24 at 17:40 -0500, Marc Schwartz wrote:

> Can these be made to write files somewhere other than /.razor etc?
> 
> Are the files written there just like the ones for regular users, e.g.
> default preference settings?

See my other reply to you and Nicolas.

> > These files:
> > 
> > /usr/bin/cdcc
> > /usr/bin/dccproc
> > 
> > are in:
> > 
> > /usr/local/bin/cdcc
> > /usr/local/bin/dccproc
> 
> Got those yesterday :-)

:-)

> > The files that are listed in /usr/libexec/dcc are in /var/dcc/libexec.
> 
> OK, added those file contexts.

Yep.  :-)

<Lot's of snippage>

> After loading the updated modules, you'll need to do:
> 
> # restorecon -rv /var/dcc

Done and new mydcc policy installed:

# semodule -l
amavis  1.0.4
clamav  1.0.1
dcc     1.0.0
myclamav        0.1.1
mydcc   0.1.6
mypostfix       0.1.0
mypyzor 0.2.1
myspamassassin  0.1.1
procmail        0.5.4
pyzor   1.0.1
razor   1.0.0


New avc's:

type=AVC msg=audit(1151269000.770:5837): avc:  denied  { search } for  pid=23000 comm="dccproc" name="dcc" dev=dm-1 ino=58510 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:dcc_var_t:s0 tclass=dir
type=SYSCALL msg=audit(1151269000.770:5837): arch=40000003 syscall=12 success=yes exit=0 a0=bfdb1202 a1=0 a2=4891eff4 a3=37 items=1 pid=23000 auid=4294967295 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0 tty=(none) comm="dccproc" exe="/usr/local/bin/dccproc" subj=system_u:system_r:spamd_t:s0
type=CWD msg=audit(1151269000.770:5837):  cwd="/"
type=PATH msg=audit(1151269000.770:5837): item=0 name="/var/dcc" inode=58510 dev=fd:01 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:dcc_var_t:s0
type=AVC msg=audit(1151269000.770:5838): avc:  denied  { read write } for  pid=23000 comm="dccproc" name="map" dev=dm-1 ino=59007 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:dcc_client_map_t:s0 tclass=file
type=SYSCALL msg=audit(1151269000.770:5838): arch=40000003 syscall=5 success=yes exit=3 a0=80ba6e0 a1=2 a2=180 a3=37 items=1 pid=23000 auid=4294967295 uid=500 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=500 fsgid=0 tty=(none) comm="dccproc" exe="/usr/local/bin/dccproc" subj=system_u:system_r:spamd_t:s0
type=CWD msg=audit(1151269000.770:5838):  cwd="/var/dcc"
type=PATH msg=audit(1151269000.770:5838): item=0 name="/var/dcc/map" inode=59007 dev=fd:01 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:dcc_client_map_t:s0
type=AVC msg=audit(1151269000.770:5839): avc:  denied  { getattr } for  pid=23000 comm="dccproc" name="map" dev=dm-1 ino=59007 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:dcc_client_map_t:s0 tclass=file
type=SYSCALL msg=audit(1151269000.770:5839): arch=40000003 syscall=197 success=yes exit=0 a0=3 a1=bfdb1018 a2=4891eff4 a3=3 items=0 pid=23000 auid=4294967295 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0 tty=(none) comm="dccproc" exe="/usr/local/bin/dccproc" subj=system_u:system_r:spamd_t:s0
type=AVC_PATH msg=audit(1151269000.770:5839):  path="/var/dcc/map"
type=AVC msg=audit(1151269000.770:5840): avc:  denied  { lock } for  pid=23000 comm="dccproc" name="map" dev=dm-1 ino=59007 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:dcc_client_map_t:s0 tclass=file
type=SYSCALL msg=audit(1151269000.770:5840): arch=40000003 syscall=221 success=yes exit=0 a0=3 a1=7 a2=bfdb2194 a3=bfdb2194 items=0 pid=23000 auid=4294967295 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0 tty=(none) comm="dccproc" exe="/usr/local/bin/dccproc" subj=system_u:system_r:spamd_t:s0
type=AVC_PATH msg=audit(1151269000.770:5840):  path="/var/dcc/map"


Thanks,

Marc