Re: postfix, procmail and SELinux - No Go

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sat, 2006-06-24 at 17:40 -0500, Marc Schwartz wrote:
> On Sat, 2006-06-24 at 10:12 +0100, Paul Howarth wrote:
> > On Thu, 2006-06-22 at 20:19 -0500, Marc Schwartz wrote:

(snip)

> > > > > /.razor/*
> > > > 
> > > > That looks rather dubious.
> > > 
> > > I initially thought that these files in / were from the initial install.
> > > 
> > > However, the dates on the log files in that path are current as of last
> > > night, when the cron jobs run.
> > 
> > What are the cron jobs doing? We need to find a way of stopping them
> > writing here. There's no way I'm going to add policy to allow this.
> 
> Here are the key entries:
> 
> # Run ClamAV Update every hour
> 00 * * * * root freshclam --quiet
> 
> # Run DCC Update at 1 am
> 00 01 * * * root /var/dcc/libexec/updatedcc > /dev/null

This one seems OK as it's not trying to write anything in the root
directory.

> # Run pyzor update at 1:10 am
> 10 01 * * * root /usr/bin/pyzor discover > /dev/null
> 
> # Run razor update at 1:20 am
> 20 01 * * * root /usr/bin/razor-admin -discover > /dev/null
> 
> 
> updatedcc downloads and builds an updated DCC client each night.
> 
> 'pyzor discover' updates the pyzor server list.
> 
> 'razor-admin -discover' does the same for the razor servers.

Can these be made to write files somewhere other than /.razor etc?

Are the files written there just like the ones for regular users, e.g.
default preference settings?

> > > type=AVC msg=audit(1151025306.136:693): avc:  denied  { search } for  pid=22051 comm="dccproc" name="dcc" dev=dm-1 ino=58510 scontex t=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:dcc_var_t:s0 tclass=dir
> > > type=SYSCALL msg=audit(1151025306.136:693): arch=40000003 syscall=12 success=yes exit=0 a0=bfe79ac2 a1=0 a2=4891eff4 a3=37 items=1 p id=22051 auid=4294967295 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0 comm="dccproc" exe="/usr/local/bin/dccproc"
> > 
> > Failed to transition to dcc type, which will be because dccproc isn't
> > labelled correctly (it's in /usr/local/bin but policy expects it
> > in /usr/bin). Please check in dcc.fc if there are any other programs not
> > in the right place.
> 
> These files:
> 
> /usr/bin/cdcc
> /usr/bin/dccproc
> 
> are in:
> 
> /usr/local/bin/cdcc
> /usr/local/bin/dccproc

Got those yesterday :-)

> The files that are listed in /usr/libexec/dcc are in /var/dcc/libexec.

OK, added those file contexts.

> # semodule -l
> amavis  1.0.4
> clamav  1.0.1
> dcc     1.0.0
> myclamav        0.1.1
> mydcc   0.1.5
> mypostfix       0.1.0
> mypyzor 0.2.1
> myspamassassin  0.1.1
> procmail        0.5.4
> pyzor   1.0.1
> razor   1.0.0
> 
> 
> New messages:
> 
> type=AVC msg=audit(1151188279.668:1444): avc:  denied  { read } for  pid=6563 comm="dccproc" name=".spamassassin2378EoApLctmp" dev=dm-2 ino=24 scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:spamd_tmp_t:s0 tclass=file
> type=SYSCALL msg=audit(1151188279.668:1444): arch=40000003 syscall=11 success=yes exit=0 a0=a6eece8 a1=9c6f400 a2=a8f8b08 a3=bfec81ac items=2 pid=6563 auid=4294967295 uid=500 gid=0 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="dccproc" exe="/usr/local/bin/dccproc" subj=system_u:system_r:dcc_client_t:s0
> type=AVC_PATH msg=audit(1151188279.668:1444):  path="/tmp/.spamassassin2378EoApLctmp"
> type=CWD msg=audit(1151188279.668:1444):  cwd="/"
> type=PATH msg=audit(1151188279.668:1444): item=0 name="/usr/local/bin/dccproc" inode=3122809 dev=16:07 mode=0104555 ouid=0 ogid=1 rdev=00:00 obj=system_u:object_r:dcc_client_exec_t:s0
> type=PATH msg=audit(1151188279.668:1444): item=1 name=(null) inode=754491 dev=16:07 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0

dccproc trying to read a temp file created by spamd.

> type=AVC msg=audit(1151188279.672:1446): avc:  denied  { search } for  pid=6563 comm="dccproc" name="dcc" dev=dm-1 ino=58510 scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir
> type=SYSCALL msg=audit(1151188279.672:1446): arch=40000003 syscall=12 success=yes exit=0 a0=bff9abe2 a1=0 a2=4891eff4 a3=37 items=1 pid=6563 auid=4294967295 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0 tty=(none) comm="dccproc" exe="/usr/local/bin/dccproc" subj=system_u:system_r:dcc_client_t:s0
> type=CWD msg=audit(1151188279.672:1446):  cwd="/"
> type=PATH msg=audit(1151188279.672:1446): item=0 name="/var/dcc" inode=58510 dev=fd:01 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:unlabeled_t:s0

/var/dcc appears to have lost its label. I wonder how that happened?

> type=AVC msg=audit(1151188279.672:1450): avc:  denied  { node_bind } for  pid=6563 comm="dccproc" scontext=system_u:system_r:dcc_client_t:s0 tcontext=system_u:object_r:inaddr_any_node_t:s0 tclass=udp_socket
> type=SYSCALL msg=audit(1151188279.672:1450): arch=40000003 syscall=102 success=yes exit=0 a0=2 a1=bff9bab0 a2=4891eff4 a3=37 items=0 pid=6563 auid=4294967295 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0 tty=(none) comm="dccproc" exe="/usr/local/bin/dccproc" subj=system_u:system_r:dcc_client_t:s0
> type=SOCKADDR msg=audit(1151188279.672:1450): saddr=02000000000000000000000000000000
> type=SOCKETCALL msg=audit(1151188279.672:1450): nargs=3 a0=4 a1=bff9bb54 a2=10

I'm not sure what's that's doing. Will look at that again later.

I'm a bit surprised that nothing has turned up for clamassassin. Can''t
believe I got that right first time...

Here's the updated policy files:

::::::::::::::
mydcc.fc
::::::::::::::
/usr/local/bin/cdcc             --
gen_context(system_u:object_r:cdcc_exec_t,s0)
/usr/local/bin/dccproc          --
gen_context(system_u:object_r:dcc_client_exec_t,s0)

/var/dcc/libexec/dbclean        --
gen_context(system_u:object_r:dcc_dbclean_exec_t,s0)
/var/dcc/libexec/dccd           --
gen_context(system_u:object_r:dccd_exec_t,s0)
/var/dcc/libexec/dccifd         --
gen_context(system_u:object_r:dccifd_exec_t,s0)
/var/dcc/libexec/dccm           --
gen_context(system_u:object_r:dccm_exec_t,s0)

::::::::::::::
mydcc.te
::::::::::::::
policy_module(mydcc, 0.1.6)

# ==================================================
# Declarations
# ==================================================

require {
        type dcc_client_t;
}

# ==================================================
# DCC client local policy
# ==================================================

spamassassin_read_spamd_tmp_files(dcc_client_t)


After loading the updated modules, you'll need to do:

# restorecon -rv /var/dcc

Paul.


--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Index of Archives]     [Fedora Users]     [Fedora Desktop]     [Big List of Linux Books]     [Yosemite News]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux