-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 04/29/2010 08:41 AM, Moray Henderson wrote:
> We have an email configuration package that often needs to restart
> sendmail when it is upgraded. To make updates as easy as possible for
> the users, it has a trigger script on sendmail that contains
> " condrestart", so that they don't have to
> remember to do that themselves.
>
> This worked fine on CentOS 4. On CentOS 5 it has a problem:
>
> # rpm -qa selinux\*
> selinux-policy-targeted-2.4.6-255.el5_4.3
> selinux-policy-2.4.6-255.el5_4.3
> selinux-policy-devel-2.4.6-255.el5_4.3
>
> Apr 29 12:40:27 ict sm-msp-queue[4024]: unable to write pid to
> /var/run/sm-client.pid: Permission denied
> time->Thu Apr 29 12:40:27 2010
> type=SYSCALL msg=audit(1272541227.852:97659096): arch=40000003
> syscall=196 success=no exit=-13 a0=bfec70d8 a1=bfec6f70 a2=4efff4 a3=3
> items=0 ppid=4023 pid=4024 auid=783 uid=51 gid=51 euid=51 suid=51
> fsuid=51 egid=51 sgid=51 fsgid=51 tty=(none) ses=23989 comm="sendmail"
> exe="/usr/sbin/sendmail.sendmail" subj=user_u:system_r:system_mail_t:s0
> key=(null)
> type=AVC msg=audit(1272541227.852:97659096): avc: denied { getattr }
> for pid=4024 comm="sendmail" path="/var/run/sm-client.pid" dev=dm-4
> ino=1097779 scontext=user_u:system_r:system_mail_t:s0
> tcontext=system_u:object_r:sendmail_var_run_t:s0 tclass=file
>
> A manual restart of sendmail works. This is because of the following
> transition rules:
>
> type_transition unconfined_t sendmail_exec_t : process sendmail_t;
> type_transition initrc_t sendmail_exec_t : process sendmail_t;
> type_transition rpm_script_t sendmail_exec_t : process system_mail_t;
>
> In other words, being run from an rpm script does not give sendmail
> enough access to restart. I don't know why there wasn't a similar error
> for /var/run/sendmail.pid, though.
>
>
> Moray.
> "To err is human. To purr, feline"
>
>
>
>
>
>
> --
> selinux mailing list
> selinux@xxxxxxxxxxxxxxxxxxxxxxx
> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
>
I think
/etc/rc.d/init.d/sendmail
is mislabeled.
Run restorecon on it.
Because using the init script with the correct label it should be
unconfined_t -> initrc_exec_t -> initrc_t -> sendmain_exec_t -> sendmail_t
rpm_script_t > initrc_exec_t -> initrc_t -> sendmain_exec_t -> sendmail_t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkvZm/oACgkQrlYvE4MpobMMdgCgh4pf9J2ykj+cQqj52vnaQVPc
yIgAn16EpHtWl3PRektuFqPqo3gWZRhg
=jyFu
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
