We have an email configuration package that often needs to restart
sendmail when it is upgraded. To make updates as easy as possible for
the users, it has a trigger script on sendmail that contains
"/etc/rc.d/init.d/sendmail condrestart", so that they don't have to
remember to do that themselves.
This worked fine on CentOS 4. On CentOS 5 it has a problem:
# rpm -qa selinux\*
selinux-policy-targeted-2.4.6-255.el5_4.3
selinux-policy-2.4.6-255.el5_4.3
selinux-policy-devel-2.4.6-255.el5_4.3
Apr 29 12:40:27 ict sm-msp-queue[4024]: unable to write pid to
/var/run/sm-client.pid: Permission denied
time->Thu Apr 29 12:40:27 2010
type=SYSCALL msg=audit(1272541227.852:97659096): arch=40000003
syscall=196 success=no exit=-13 a0=bfec70d8 a1=bfec6f70 a2=4efff4 a3=3
items=0 ppid=4023 pid=4024 auid=783 uid=51 gid=51 euid=51 suid=51
fsuid=51 egid=51 sgid=51 fsgid=51 tty=(none) ses=23989 comm="sendmail"
exe="/usr/sbin/sendmail.sendmail" subj=user_u:system_r:system_mail_t:s0
key=(null)
type=AVC msg=audit(1272541227.852:97659096): avc: denied { getattr }
for pid=4024 comm="sendmail" path="/var/run/sm-client.pid" dev=dm-4
ino=1097779 scontext=user_u:system_r:system_mail_t:s0
tcontext=system_u:object_r:sendmail_var_run_t:s0 tclass=file
A manual restart of sendmail works. This is because of the following
transition rules:
type_transition unconfined_t sendmail_exec_t : process sendmail_t;
type_transition initrc_t sendmail_exec_t : process sendmail_t;
type_transition rpm_script_t sendmail_exec_t : process system_mail_t;
In other words, being run from an rpm script does not give sendmail
enough access to restart. I don't know why there wasn't a similar error
for /var/run/sendmail.pid, though.
Moray.
"To err is human. To purr, feline"
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
