Thank you for replying.
On 2/5/19 2:06 AM, Thomas Mueller wrote:
On 2/4/19 8:55 PM, Robert Moskowitz wrote:
I am working with Centos7:
I have configured Dovecot to connect to mysqld via socket:
connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix
password=Postfix_Database_Password
I test sending a message with
sendmail -i rgm@xxxxxxxxxxxxxxxxxxxx < README
This fails with the following message in maillog
Feb 4 11:28:48 klovia dovecot: dict(13122): Error:
mysql(/var/lib/mysql/mysql.sock): Connect failed to database
(postfix): Can't connect to local MySQL server through socket
'/var/lib/mysql/mysql.sock' (13) - waiting for 25 seconds before retry
SELinux denials are logged with auditd:
# show some summary (recent = last 10min)
aureport --avc --start recent
A number of dovecot_t errors. e.g.
18. 02/05/2019 08:38:44 dict system_u:system_r:dovecot_t:s0 195 file
getattr unconfined_u:object_r:mysqld_etc_t:s0 denied 578
But after I setenforce 0, I see:
32. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 195 file
getattr unconfined_u:object_r:mysqld_etc_t:s0 denied 593
33. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file read
unconfined_u:object_r:mysqld_etc_t:s0 denied 594
34. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file open
unconfined_u:object_r:mysqld_etc_t:s0 denied 594
35. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 322 dir read
unconfined_u:object_r:mysqld_etc_t:s0 denied 595
36. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 195 file
getattr system_u:object_r:mysqld_etc_t:s0 denied 596
37. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file read
system_u:object_r:mysqld_etc_t:s0 denied 597
38. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file open
system_u:object_r:mysqld_etc_t:s0 denied 597
39. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 283
unix_stream_socket connectto system_u:system_r:mysqld_t:s0 denied 598
# if it's the dovecot_t type that spits AVC denials, then you probably
could create dummy policy by using the audit2allow tool:
ausearch -m AVC --context dovecot_t | audit2allow --reference -m
dovecot_mysql_custom
This throws an error:
could not open interface info [/var/lib/sepolgen/interface_info]
But I was hoping that there were better tools now with Centos7. I
checked for setsebool at:
https://linux.die.net/man/8/mysqld_selinux
I would lookup this the other way around: is there a boolean that
allows dovecot to connect to mysql?
but there doesnt seem to be one:
https://github.com/fedora-selinux/selinux-policy-contrib/blob/rawhide/dovecot.te
the mysql policy provides an interfacee to allow access to it's socket:
https://github.com/fedora-selinux/selinux-policy-contrib/blob/rawhide/mysql.if#L107
Using this is rather beyond me. I would need a lot of guidance.
this could be used in the policy allowing the access.
- Thomas
_______________________________________________
selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx
_______________________________________________
selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx
