On 09/23/2009 07:47 AM, John Griffiths wrote:
> I am using selinux-policy-targeted-3.5.13-71.fc10.noarch on Fedora 10. I am
> getting these AVCs. They do not seem to inhibit functionality but still
> troublesome to get the selinux alerts all the time. Are these bugs in the policy
> or something that will not be addressed and I need to generate local policy?
>
> 1) SELinux is preventing postdrop (postfix_postdrop_t) "getattr" httpd_t.
>
> Raw Audit Messages :
>
> node=elijah.suretrak21.net type=AVC msg=audit(1253716264.867:65886): avc:
> denied { getattr } for pid=30094 comm="postdrop" path="pipe:[2618550]"
> dev=pipefs ino=2618550 scontext=system_u:system_r:postfix_postdrop_t:s0
> tcontext=system_u:system_r:httpd_t:s0 tclass=fifo_file
>
> node=elijah.suretrak21.net type=SYSCALL msg=audit(1253716264.867:65886):
> arch=40000003 syscall=197 success=no exit=-13 a0=2 a1=bfc167c8 a2=94eff4
> a3=2 items=0 ppid=30093 pid=30094 auid=4294967295 uid=48 gid=48 euid=48
> suid=48 fsuid=48 egid=90 sgid=90 fsgid=90 tty=(none) ses=4294967295
> comm="postdrop" exe="/usr/sbin/postdrop"
> subj=system_u:system_r:postfix_postdrop_t:s0 key=(null)
This seems a little strange, is postfix being executed from apache? I would guess that postfix does not communicate with apache via fifo_file, so might be a leak.
>
> 2) SELinux is preventing sendmail (system_mail_t) "read" to
> /usr/share/GeoIP/GeoIP.dat (usr_t).
>
> Raw Audit Messages :
>
> node=elijah.suretrak21.net type=AVC msg=audit(1253643380.763:60806): avc:
> denied { read } for pid=1311 comm="sendmail"
> path="/usr/share/GeoIP/GeoIP.dat" dev=dm-0 ino=663651
> scontext=system_u:system_r:system_mail_t:s0
> tcontext=system_u:object_r:usr_t:s0 tclass=file
>
> node=elijah.suretrak21.net type=SYSCALL msg=audit(1253643380.763:60806):
> arch=40000003 syscall=11 success=yes exit=0 a0=9ad05d0 a1=9acfd18 a2=9acfb08
> a3=0 items=0 ppid=14784 pid=1311 auid=4294967295 uid=48 gid=48 euid=48
> suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295
> comm="sendmail" exe="/usr/sbin/sendmail.postfix"
> subj=system_u:system_r:system_mail_t:s0 key=(null)
>
This one looks like a leak unless something is actually trying to mail /usr/share/GeoIP/GeoIP.dat
> Regards,
> John Griffiths
>
>
> ------------------------------------------------------------------------
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@xxxxxxxxxx
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
You can add custom policy to allow these by executing audit2allow -M mypol
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
