How to execute a Perl script in ~/.procmailrc with SELinux set to Enforcing?

thomasz · 03-14-2008, 02:30 AM

Hi!

I am installing the mail processor for Request-Tracker (RT). The basic idea is to forward all messages for a certain subdomain (i.e. rt.company.com) to a specific user and then execute a Perl script for each message using procmail.

My system is running CentOS 5.1 and sendmail. SELinux is enabled and set to enforcing mode.

I have setup the processing rules to ~/.procmailrc for the user:

Code:

# Uncomment VERBOSE and LOGFILE for debugging, they're helpful at times.
VERBOSE=1
LOGFILE=$HOME/.procmail.log
LOCKFILE=$HOME/.procmail.LCK
ARG1=$1
EXTENSION=`echo $ARG1 | awk -F. '{ print $1 }'`
SUFFIX=`echo $ARG1 | awk -F. '{ print $2 }'`

# if spam, drop it!
:0:
* ^X-Spam-Status: Yes
/dev/null

# if no list of actions, default action is correspond
:0
* ? test -z "$SUFFIX"
|/etc/smrsh/rt-mailgate --extension queue --action correspond --url url-removed

# Otherwise, if we DO have a list of actions, run with them. 
:0 E
* ? test ! -z "$SUFFIX"
{
  :0
  |/etc/smrsh/rt-mailgate --extension queue --action $SUFFIX --url url-removed
}

When a message is received SELinux forbids the execution of the Perl script:

Code:

type=AVC msg=audit(1205484249.254:4985): avc:  denied  { execute } for  pid=4016 comm="procmail" name="rt-mailgate" dev=dm-0 ino=278496 scontext=user_u:system_r:procmail_t:s0 tcontext=system_u:object_r:sbin_t:s0 tclass=file
type=SYSCALL msg=audit(1205484249.254:4985): arch=40000003 syscall=11 success=no exit=-13 a0=8c1cd90 a1=8c1e980 a2=8c1ebb0 a3=6 items=0 ppid=4006 pid=4016 auid=500 uid=505 gid=507 euid=505 suid=505 fsuid=505 egid=507 sgid=12 fsgid=507 tty=(none) comm="procmail" exe="/usr/bin/procmail" subj=user_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1205484249.260:4986): avc:  denied  { read } for  pid=4016 comm="sh" name="rt-mailgate" dev=dm-0 ino=278496 scontext=user_u:system_r:procmail_t:s0 tcontext=system_u:object_r:sbin_t:s0 tclass=file
type=SYSCALL msg=audit(1205484249.260:4986): arch=40000003 syscall=5 success=no exit=-13 a0=8615360 a1=8000 a2=0 a3=8000 items=0 ppid=1 pid=4016 auid=500 uid=505 gid=507 euid=505 suid=505 fsuid=505 egid=507 sgid=507 fsgid=507 tty=(none) comm="sh" exe="/bin/bash" subj=user_u:system_r:procmail_t:s0 key=(null)

I have tried executing the script /usr/sbin/rt-mailgate directly and by using a symbolic link /etc/smrsh/rt-mailgate. They both fail.

Code:

# ls -la /usr/sbin/rt-mailgate 
-rwxr-xr-x 1 root root 9836 13. maalis 14:05 /usr/sbin/rt-mailgate
# ls -la /etc/smrsh/rt-mailgate 
lrwxrwxrwx 1 root root 21 13. maalis 23:34 /etc/smrsh/rt-mailgate -> /usr/sbin/rt-mailgate

The obvious solution that multiple guides mention is to disable SELinux, but I don't want to do that. Another solution is to use /etc/aliases, but then I would have to maintain that file everytime a new ticket queue is added to RT.

Any idea how I can allow procmail and the user to execute the script without disabling SELinux?

Thank you in advance!

Best regards,
Thomas

unSpawn · 03-14-2008, 05:25 AM