On Wed, 2006-06-28 at 15:56 -0500, Marc Schwartz (via MN) wrote:
> On Wed, 2006-06-28 at 21:13 +0100, Paul Howarth wrote:
> > On Wed, 2006-06-28 at 14:22 -0500, Marc Schwartz (via MN) wrote:
> > > New avc's:
> > >
> > > type=AVC msg=audit(1151521329.964:1158): avc: denied { search } for pid=5442 comm="local" name="clamav" dev=dm-1 ino=44957 scontext=system_u:system_r:postfix_local_t:s0 tcontext=system_u:object_r:clamd_var_lib_t:s0 tclass=dir
> > > type=SYSCALL msg=audit(1151521329.964:1158): arch=40000003 syscall=196 success=no exit=-2 a0=939f848 a1=bffd2e80 a2=721ff4 a3=3 items=1 pid=5442 auid=4294967295 uid=0 gid=0 euid=100 suid=0 fsuid=100 egid=101 sgid=0 fsgid=101 tty=(none) comm="local" exe="/usr/libexec/postfix/local" subj=system_u:system_r:postfix_local_t:s0
> > > type=CWD msg=audit(1151521329.964:1158): cwd="/var/spool/postfix"
> > > type=PATH msg=audit(1151521329.964:1158): item=0 name="/var/lib/clamav/.forward" obj=system_u:object_r:etc_t:s0
> >
> > postfix local looking in /var/lib/clamav
> >
> > > type=AVC msg=audit(1151521329.988:1159): avc: denied { search } for pid=5449 comm="procmail" name="clamav" dev=dm-1 ino=44957 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:clamd_var_lib_t:s0 tclass=dir
> > > type=SYSCALL msg=audit(1151521329.988:1159): arch=40000003 syscall=195 success=no exit=-2 a0=8dd0d60 a1=bfe27a6c a2=4891eff4 a3=0 items=1 pid=5449 auid=4294967295 uid=100 gid=101 euid=100 suid=100 fsuid=100 egid=101 sgid=101 fsgid=101 tty=(none) comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0
> > > type=CWD msg=audit(1151521329.988:1159): cwd="/var/spool/postfix"
> >
> > same for procmail
> >
> > This appears to be postfix local and procmail trying to
> > read /var/lib/clamav/.forward; does that sound reasonable?
>
> There are no .forward files on my system at all, unless that is a temp
> file, which does not make sense location-wise.
>
> A Google search came up empty for that file, so I can only presume that
> there are certain configuration scenarios where the pipelining of
> e-mails would require that file.
>
> Since I am using clamassassin, I also searched through that script and
> noted nothing relevant here.
>
> Not sure what else to make of it.
That might be dontaudit-able. Is /var/lib/clamav any user's home
directory?
> > You can bump myclamav.te to version 0.1.5 and append the following:
> >
> > # ===========================================
> > # things that should be done via an interface
> > # ===========================================
> > allow postfix_local_t clamd_var_lib_t:dir r_dir_perms;
> > allow procmail_t clamd_var_lib_t:dir r_dir_perms;
> >
> > Paul.
>
> Done, including the add in your second e-mail.
>
> # semodule -l
> amavis 1.0.4
> clamav 1.0.1
> dcc 1.0.0
> myclamav 0.1.5
> mydcc 0.1.8
> mypostfix 0.1.0
> mypyzor 0.2.3
> myspamassassin 0.1.1
> procmail 0.5.4
> pyzor 1.0.1
> razor 1.0.0
>
>
> No further avc's at this time.
>
> Is it time to venture back into the Enforcing World once again?
Give it a try. Bear in mind it may fail if any of the dontaudit rules
should be allows instead.
Paul.
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
