sendmail selinux error

mail2mphani · 08-19-2009, 03:52 AM

hi i configured sendmail with squirrelmail in RHEL5.3

it is working fine. i can send the mail and receive the mail .

but when i try to send the mail a selinux error is coming[but mail is sending successfully ]. i don't under stand this message.

Quote:

Summary:

SELinux is preventing sendmail (system_mail_t) "read" to eventpoll (httpd_t).

Detailed Description:

SELinux denied access requested by sendmail. It is not expected that this access
is required by sendmail and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for eventpoll,

restorecon -v 'eventpoll'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinu...fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context system_u:system_r:system_mail_t
Target Context system_u:system_r:httpd_t
Target Objects eventpoll [ file ]
Source sendmail
Source Path /usr/sbin/sendmail.sendmail
Port <Unknown>
Host mail.example.com
Source RPM Packages sendmail-8.13.8-2.el5
Target RPM Packages
Policy RPM selinux-policy-2.4.6-203.el5
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name mail.example.com
Platform Linux mail.example.com 2.6.18-128.el5 #1 SMP Wed
Dec 17 11:42:39 EST 2008 i686 i686
Alert Count 1
First Seen Wed 19 Aug 2009 06:30:39 PM IST
Last Seen Wed 19 Aug 2009 06:30:39 PM IST
Local ID ca349210-0a7a-4ff3-8fc6-39ba268c6ac8
Line Numbers

Raw Audit Messages

host=mail.example.com type=AVC msg=audit(1250686839.94:107): avc: denied { read } for pid=4249 comm="sendmail" path="eventpoll:[7625]" dev=eventpollfs ino=7625 scontext=system_u:system_r:system_mail_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=file

host=mail.example.com type=SYSCALL msg=audit(1250686839.94:107): arch=40000003 syscall=11 success=yes exit=0 a0=87abd90 a1=87ac120 a2=87abea0 a3=40 items=0 ppid=2295 pid=4249 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=51 sgid=51 fsgid=51 tty=(none) ses=4294967295 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:system_mail_t:s0 key=(null)

unSpawn · 08-19-2009, 05:42 AM

Running the raw messages through 'audit2allow' shows you need a local policy of:

Code:

#============= system_mail_t ==============
allow system_mail_t httpd_t:file read;

so I'm wondering what does running 'getsebool -a|egrep -ie "(mail|http)"' return?

mail2mphani · 08-19-2009, 07:04 AM

Quote:

getsebool -a|egrep -ie "(mail|http)"' return?

it returns

Quote:

allow_httpd_anon_write --> off
allow_httpd_bugzilla_script_anon_write --> off
allow_httpd_mod_auth_pam --> off
allow_httpd_nagios_script_anon_write --> off
allow_httpd_prewikka_script_anon_write --> off
allow_httpd_squid_script_anon_write --> off
allow_httpd_sys_script_anon_write --> off
allow_postfix_local_write_mail_spool --> off
fetchmail_disable_trans --> off
httpd_builtin_scripting --> on
httpd_can_network_connect --> off
httpd_can_network_connect_db --> off
httpd_can_network_relay --> off
httpd_can_sendmail --> on
httpd_disable_trans --> off
httpd_enable_cgi --> on
httpd_enable_ftp_server --> off
httpd_enable_homedirs --> on
httpd_rotatelogs_disable_trans --> off
httpd_ssi_exec --> off
httpd_suexec_disable_trans --> off
httpd_tty_comm --> on
httpd_unified --> on
httpd_use_cifs --> off
httpd_use_nfs --> off
mail_read_content --> off
mailman_mail_disable_trans --> off

unSpawn · 08-19-2009, 03:01 PM

OK. I don't see no boolean that would "allow system_mail_t httpd_t:file read;", so for the time being you could adjust your local policy, see: Creating Custom SELinux Policy Modules with audit2allow and let us know if that didn't work.