Nicolas Mailhot wrote:
Le mardi 30 mai 2006 à 15:58 -0500, Marc Schwartz (via MN) a écrit :
<snip>
Paul,
Thanks for your assistance.
Give me a bit of time, with everything else (ie. work) going on, to
implement and test your recommendations (and to review some
documentation).
I'll post back as soon as I have something definitive.
On your query on pyzor, much like razor and dcc, it is called as part of
the spamassassin checks when present. These constitute the 'remote'
checks that one can perform when using SA. This is why I find it curious
that there were no avc messages for razor and dcc.
are you sure razor and dcc are used ? Last I looked the FC version of SA
disabled the razor check because of licensing problems
As for pyzor, I've reported it in the past, you need the policy to allow
reading its config file, then connecting to pyzor servers, etc
Nicolas,
Thanks kindly for making note of this.
In SA 3.1.x, which is new to FC5, these checks are indeed disabled. From
some Googling, this appears to not be unique to FC, but to SA itself.
In FC4, which used SA 3.0.x, these checks worked fine without
adjustments to config files. I was not aware of the change.
I have now edited:
/etc/mail/spamassassin/v310pre
to enable the checks. I also did some fine tuning to
~/.spamassassin/user.prefs to account for some setting changes as well.
Sure enough, avc messages are now being logged. I have cc'd Paul to
reference the additional info below:
Now for grep "dcc":
type=SYSCALL msg=audit(1149104051.041:8648): arch=40000003 syscall=197
success=yes exit=0 a0=4 a1=bfaad188 a2=4891eff4 a3=3 items=0 pi d=25104
auid=500 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0
comm="dccproc" exe="/usr/local/bin/dccproc"
type=AVC_PATH msg=audit(1149104051.041:8648): path="/var/dcc/map"
type=AVC msg=audit(1149104051.041:8649): avc: denied { lock } for
pid=25104 comm="dccproc" name="map" dev=hdc5 ino=87811 scontext=s
ystem_u:system_r:spamd_t:s0 tcontext=user_u:object_r:var_t:s0 tclass=file
type=SYSCALL msg=audit(1149104051.041:8649): arch=40000003 syscall=221
success=yes exit=0 a0=4 a1=7 a2=bfaae304 a3=bfaae304 items=0 pi d=25104
auid=500 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0
comm="dccproc" exe="/usr/local/bin/dccproc"
type=AVC_PATH msg=audit(1149104051.041:8649): path="/var/dcc/map"
type=AVC msg=audit(1149104167.275:8694): avc: denied { read write }
for pid=25544 comm="dccproc" name="map" dev=hdc5 ino=87811 scon
text=system_u:system_r:spamd_t:s0 tcontext=user_u:object_r:var_t:s0
tclass=file
type=SYSCALL msg=audit(1149104167.275:8694): arch=40000003 syscall=5
success=yes exit=4 a0=80ba6e0 a1=2 a2=180 a3=11 items=1 pid=25544
auid=500 uid=500 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=500 fsgid=0
comm="dccproc" exe="/usr/local/bin/dccproc"
type=CWD msg=audit(1149104167.275:8694): cwd="/var/dcc"
type=PATH msg=audit(1149104167.275:8694): item=0 name="/var/dcc/map"
flags=101 inode=87811 dev=16:05 mode=0100600 ouid=0 ogid=0 rdev= 00:00
type=AVC msg=audit(1149104167.275:8695): avc: denied { getattr } for
pid=25544 comm="dccproc" name="map" dev=hdc5 ino=87811 scontex
t=system_u:system_r:spamd_t:s0 tcontext=user_u:object_r:var_t:s0 tclass=file
type=SYSCALL msg=audit(1149104167.275:8695): arch=40000003 syscall=197
success=yes exit=0 a0=4 a1=bfbf5cc8 a2=4891eff4 a3=3 items=0 pi d=25544
auid=500 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0
comm="dccproc" exe="/usr/local/bin/dccproc"
type=AVC_PATH msg=audit(1149104167.275:8695): path="/var/dcc/map"
type=AVC msg=audit(1149104167.275:8696): avc: denied { lock } for
pid=25544 comm="dccproc" name="map" dev=hdc5 ino=87811 scontext=s
ystem_u:system_r:spamd_t:s0 tcontext=user_u:object_r:var_t:s0 tclass=file
type=SYSCALL msg=audit(1149104167.275:8696): arch=40000003 syscall=221
success=yes exit=0 a0=4 a1=7 a2=bfbf6e44 a3=bfbf6e44 items=0 pi d=25544
auid=500 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0
comm="dccproc" exe="/usr/local/bin/dccproc"
type=AVC_PATH msg=audit(1149104167.275:8696): path="/var/dcc/map"
For grep "razor":
type=AVC msg=audit(1149102177.498:8243): avc: denied { append } for
pid=20136 comm="spamd" name="razor-agent.log" dev=hdc7 ino=98923
scontext=system_u:system_r:spamd_t:s0
tcontext=system_u:object_r:default_t:s0 tclass=file
type=PATH msg=audit(1149102177.498:8243): item=0 name="razor-agent.log"
flags=310 inode=2 dev=16:07 mode=040755 ouid=0 ogid=0 rdev=00:00
type=AVC msg=audit(1149102177.498:8244): avc: denied { ioctl } for
pid=20136 comm="spamd" name="razor-agent.log" dev=hdc7 ino=98923
scontext=system_u:system_r:spamd_t:s0
tcontext=system_u:object_r:default_t:s0 tclass=file
type=AVC_PATH msg=audit(1149102177.498:8244): path="/razor-agent.log"
type=AVC msg=audit(1149102177.498:8245): avc: denied { getattr } for
pid=20136 comm="spamd" name="razor-agent.log" dev=hdc7 ino=98923
scontext=system_u:system_r:spamd_t:s0
tcontext=system_u:object_r:default_t:s0 tclass=file
type=AVC_PATH msg=audit(1149102177.498:8245): path="/razor-agent.log"
type=AVC msg=audit(1149102177.530:8246): avc: denied { add_name } for
pid=20136 comm="spamd" name=".razor"
scontext=system_u:system_r:spamd_t:s0
tcontext=root:object_r:user_home_dir_t:s0 tclass=dir
type=AVC msg=audit(1149102177.530:8246): avc: denied { create } for
pid=20136 comm="spamd" name=".razor"
scontext=system_u:system_r:spamd_t:s0
tcontext=system_u:object_r:user_home_dir_t:s0 tclass=dir
type=PATH msg=audit(1149102177.530:8246): item=0 name="/root/.razor"
flags=10 inode=65537 dev=16:07 mode=040750 ouid=0 ogid=0 rdev=00:00
type=AVC msg=audit(1149102177.554:8247): avc: denied { read } for
pid=20136 comm="spamd" name=".razor" dev=hdc7 ino=829589
scontext=system_u:system_r:spamd_t:s0
tcontext=system_u:object_r:user_home_dir_t:s0 tclass=dir
type=PATH msg=audit(1149102177.554:8247): item=0 name="/root/.razor"
flags=103 inode=829589 dev=16:07 mode=040755 ouid=0 ogid=0 rdev=00:00
type=AVC msg=audit(1149102178.058:8248): avc: denied { write } for
pid=20136 comm="spamd" name=".razor" dev=hdc7 ino=829589
scontext=system_u:system_r:spamd_t:s0
tcontext=system_u:object_r:user_home_dir_t:s0 tclass=dir
type=PATH msg=audit(1149102178.058:8248): item=0
name="/root/.razor/servers.discovery.lst.lock" flags=310 inode=829589
dev=16:07 mode=040755 ouid=0 ogid=0 rdev=00:00
type=AVC_PATH msg=audit(1149102178.058:8249):
path="/root/.razor/servers.discovery.lst.lock"
type=AVC_PATH msg=audit(1149102178.058:8250):
path="/root/.razor/servers.discovery.lst.lock"
type=AVC_PATH msg=audit(1149102178.058:8251):
path="/root/.razor/servers.discovery.lst"
type=PATH msg=audit(1149102178.058:8252): item=0
name="/root/.razor/servers.discovery.lst.lock" flags=10 inode=829589
dev=16:07 mode=040755 ouid=0 ogid=0 rdev=00:00
I think that the last few messages for razor have to do with server
configuration for 'root', not actual calls to the razor checks via SA.
I am now seeing razor check hits in incoming e-mail headers. Have not
seen any for DCC yet.
Paul, I will reply to your other post momentarily.
Thanks to both of you.
Marc
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
