On Jun 7, 2006, at 11:19 AM, Lazy wrote:
Hello,
I'm using the targeted policy.
PHP's mail() function fails because of selinux.
audit(1149662369.454:2): avc: denied { setgid } for pid=18085
comm="sendmail" capability=6 scontext=root:system_r:httpd_sys_script_t
tcontext=root:system_r:httpd_sys_script_t tclass=capability
When i turn to permisive mode:
audit(1149668677.105:12): avc: denied { setuid } for pid=29159
comm="sendmail" capability=7 scontext=root:system_r:ht
tpd_sys_script_t tcontext=root:system_r:httpd_sys_script_t
tclass=capability
audit(1149668677.157:13): avc: denied { dac_override } for
pid=29159 comm="sendmail" capability=1 scontext=root:syste
m_r:httpd_sys_script_t tcontext=root:system_r:httpd_sys_script_t
tclass=capability
audit(1149668677.209:14): avc: denied { write } for pid=29159
comm="sendmail" name="input" dev=dm-3 ino=1335707 scont
ext=root:system_r:httpd_sys_script_t
tcontext=system_u:object_r:var_spool_t tclass=dir
audit(1149668677.209:15): avc: denied { add_name } for pid=29159
comm="sendmail" name="1FntLB-0007aJ-6i-D" scontext=r
oot:system_r:httpd_sys_script_t tcontext=system_u:object_r:var_spool_t
tclass=dir
Maybe there should be a context change to some mta specific context
diuring the execution of /usr/sbin/sendmail.
ls -Z /usr/zbin
-rwsr-xr-x root root system_u:object_r:sbin_t /usr/
sbin/exim
lrwxrwxrwx root root root:object_r:sbin_t
/usr/sbin/sendmail -> /etc/alternatives/mta
lrwxrwxrwx root root system_u:object_r:sbin_t
/usr/sbin/sendmail.exim -> exim
Maybe exim shuld be sendmail_exec_t ?
I can't experiment now. Will try setting it later.
Can anyone give me some guaidance ?
audit2allow is very helpful. It will tell you what policies you need
to add to mitigate a denial. It's in the policycoreutils rpm. There
seems to be no man page for it on CentOS, but
audit2allow </var/log/messages
is probably what you want.
Tony Schreiner
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
