postfix and selinux [selinux updates broke postfix?]
Hi all, I've been looking at this again, your input will be appreciated :)
I did a "yum update" to install selinux updates Code:
Mar 10 05:34:54 Updated: selinux-policy-3.3.1-135.fc9.noarch I want to get postfix sending emails without having to disable selinux :S I can start postfix and it sends emails with selinux off | SETENFORCE 0 If i then SETENFORCE 1 without stopping postfix the service still runs but doesnt sendmail :S Code:
Mar 11 05:24:38 HOSTNAME postfix/cleanup[27957]: fatal: open lock file pid/unix.cleanup: cannot open file: Permission denied BACKGROUND INFO Hi all, all this is done by looking at forums/docs on the net; So my server has been running fine for a year or so, i use postfix and dovecot; I wanted to update some mailboxes so i added a user Code:
adduser -s /sbin/nologin sales; passwd info Code:
sales: postmaster Code:
#sales: postmaster Code:
newaliases Code:
/etc/init.d/postfix restart futher reading and log file viewing showed an avc: denied message so i turned of selinux Code:
setenforce 0 Code:
/etc/init.d/postfix restart great, reading futher i did a "yum update" to install selinux updates Code:
Mar 10 05:34:54 Updated: selinux-policy-3.3.1-135.fc9.noarch ok so after the SELINUX update, now POSTFIX wont send mails if SELINUX is turned on !! I found this on bugzilla Code:
https,//bugzilla.redhat,com/show_bug.cgi?id=553492 "Bug 553492 - New selinux packages broke Postfix " "One of my mailservers running postfix has suddenly stopped sending mail" Same problem as me, postfix has stopped sending emails with selinux turned on after selinux updates! Can anyone help cos the bugzilla posts freak me out, i have no-idea about below Code:
Create a file called mypostfix.te with the following content. Help a nub out please :) Regards :) |
The steps you found on Red Hat's bugzilla site should fix your problem. There are three steps to follow. First create the text file as instructed. Second, use "make" to create a module to install into SELinux. Then finally, install the newly created module.
Have you followed the bugzilla steps yet, or have you been waiting for a reply? I had the same problem with Postfix on CentOS a month or three back, and the fix you found fixed it for me :) |
Quote:
|
BTW, a later update to SELinux was delivered for CentOS that solved the issue as well. This might not have filtered down to FC9 yet though. If you've just received the Postfix bug, it might be another couple of weeks before the SELinux policy fix arrives :)
|
I don't get it :S
I made a file called mypostfix.pp and uploaded it to my root folder; its content is; Code:
policy_module(mypostfix, 1.0) Code:
make -f /usr/share/selinux/devel/Makefile Code:
make -f mypostfix.pp Code:
semodule -i mypostfix.pp |
The text file is meant to have a suffix of te, not pp. The make command should create the pp file.
|
Renamed it but still get
Code:
make -f mypostfix.te Code:
policy_module(mypostfix, 1.0) |
Gonna try and use linux to create the file via the ssh screen, i used notepad++ on windows2000 to make the file, then just tried the notepad++ "convert to unix format" and still no joy, gonna see if i can figure out how to make the file ...(VI perhaps) I'm such a nub :)
|
It doesn't look quite right to me. Try this file:-
Code:
module postfix 1.0; |
touch mypostfix.te
vi mypostfix.te (edited empty file) Code:
cat mypostfix.te Code:
make -f mypostfix.te so i pasted your code into vi Code:
cat mypostfix.te Code:
make -f mypostfix.te aww the joys of the learning curve ;( |
Do you have the SELinux development package installed?
Code:
rpm -qa | grep selinux-policy-devel So, get the RPM installed and we'll start again using these commands (assuming you've already created the text file mypostfix.te:- Code:
make -f /usr/share/selinux/devel/Makefile |
I'm not sure if this will help - but a quick google on 'missing separator' gives this...
"Unlike most other Make programs which accept any whitespace character at the beginning of a command in a rule, GNU Make insists that every such line begins with a TAB. (Most other Unix Make programs also require TABs, and the Posix standard requires it as well.) Make sure that the line whose number is printed in the error message (in this case, line 1) begins with a TAB." BTW From your last paste on the make, is that space supposed to be there or is it a cut/paste typo? |
YAY!
Code:
yum install selinux-policy-devel Code:
make -f /usr/share/selinux/devel/Makefile Code:
[root@HOSTNAME ~]# semodule -i mypostfix.pp Gonna start postfix now and check to see if it sends mail with setenforce 1 fingers crossed.... |
Also, stick with the original text file you found here:- https://bugzilla.redhat.com/show_bug.cgi?id=553492
|
:(
still have to disable selinux to get mail to send; still have these messages in maillog and message Code:
Mar 12 06:03:52 HOSTNAME postfix/cleanup[7581]: fatal: open lock file pid/unix.cleanup: cannot open file: Permission denied Code:
Mar 12 06:03:52 HOSTNAME kernel: type=1400 audit(1268373832.566:232533): avc: denied { connectto } for pid=7581 comm="cleanup" path="/var/run/nscd/socket" scontext=unconfined_u:system_r:postfix_cleanup_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket Should the command Code:
[root@HOSTNAME ~]# semodule -i mypostfix.pp I confirm the files the make command created are mypostfix.fc mypostfix.if mypostfix.pp and i used Code:
policy_module(mypostfix, 1.0) Thankyou again for taking the time to help me |
All times are GMT -5. The time now is 06:09 PM. |