On Wed, 2006-06-28 at 14:22 -0500, Marc Schwartz (via MN) wrote:
> On Wed, 2006-06-28 at 15:08 +0100, Paul Howarth wrote:
> > On Tue, 2006-06-27 at 12:34 -0500, Marc Schwartz (via MN) wrote:
>
> <snip old avc's>
>
> > > One thing to note here. I am on the new kernel: 2.6.17-1.2139_FC5
> > >
> > > There have been some flaky things going on with networking as you may
> > > have noted on the general FC list, just in case any of that is relevant
> > > here. I have not installed the new (updates testing) initscripts as of
> > > yet, as I am still trying to get a sense of where things stand. I have
> > > seen some issues with network configs and device labelling issues,
> > > including wireless instability (using the bcm43xx driver) which was
> > > working under the former kernel with ndiswrapper. FWIW.
> >
> > I don't think that any of the above AVCs are related to this.
>
> OK. Wanted to make note of it, just in case.
>
> <snip new policies>
>
> # semodule -l
> amavis 1.0.4
> clamav 1.0.1
> dcc 1.0.0
> myclamav 0.1.4
> mydcc 0.1.8
> mypostfix 0.1.0
> mypyzor 0.2.3
> myspamassassin 0.1.1
> procmail 0.5.4
> pyzor 1.0.1
> razor 1.0.0
>
>
> New avc's:
>
> type=AVC msg=audit(1151521329.964:1158): avc: denied { search } for pid=5442 comm="local" name="clamav" dev=dm-1 ino=44957 scontext=system_u:system_r:postfix_local_t:s0 tcontext=system_u:object_r:clamd_var_lib_t:s0 tclass=dir
> type=SYSCALL msg=audit(1151521329.964:1158): arch=40000003 syscall=196 success=no exit=-2 a0=939f848 a1=bffd2e80 a2=721ff4 a3=3 items=1 pid=5442 auid=4294967295 uid=0 gid=0 euid=100 suid=0 fsuid=100 egid=101 sgid=0 fsgid=101 tty=(none) comm="local" exe="/usr/libexec/postfix/local" subj=system_u:system_r:postfix_local_t:s0
> type=CWD msg=audit(1151521329.964:1158): cwd="/var/spool/postfix"
> type=PATH msg=audit(1151521329.964:1158): item=0 name="/var/lib/clamav/.forward" obj=system_u:object_r:etc_t:s0
postfix local looking in /var/lib/clamav
> type=AVC msg=audit(1151521329.988:1159): avc: denied { search } for pid=5449 comm="procmail" name="clamav" dev=dm-1 ino=44957 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:clamd_var_lib_t:s0 tclass=dir
> type=SYSCALL msg=audit(1151521329.988:1159): arch=40000003 syscall=195 success=no exit=-2 a0=8dd0d60 a1=bfe27a6c a2=4891eff4 a3=0 items=1 pid=5449 auid=4294967295 uid=100 gid=101 euid=100 suid=100 fsuid=100 egid=101 sgid=101 fsgid=101 tty=(none) comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0
> type=CWD msg=audit(1151521329.988:1159): cwd="/var/spool/postfix"
same for procmail
This appears to be postfix local and procmail trying to
read /var/lib/clamav/.forward; does that sound reasonable?
You can bump myclamav.te to version 0.1.5 and append the following:
# ===========================================
# things that should be done via an interface
# ===========================================
allow postfix_local_t clamd_var_lib_t:dir r_dir_perms;
allow procmail_t clamd_var_lib_t:dir r_dir_perms;
Paul.
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
