#707293 selinux-policy-default: selinux prevent rsyslog from creating /dev/log in the postfix chroot

Package:
selinux-policy-default
Source:
refpolicy
Submitter:
Michael Scherer
Date:
2013-08-10 19:39:05 UTC
Severity:
normal
#707293#5
Date:
2013-05-08 20:23:57 UTC
From:
To:
Hi,
Using the default postfix configuration and selinux, there is several AVC in the logs like this

avc:  denied  { write } for  pid=548 comm="rsyslogd" name="dev" dev=sda1 ino=137040 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:postfix_spool_t:s0 tclass=dir
avc:  denied  { add_name } for  pid=548 comm="rsyslogd" name="log" scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:postfix_spool_t:s0 tclass=dir
avc:  denied  { create } for  pid=548 comm="rsyslogd" name="log" scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:postfix_spool_t:s0 tclass=sock_file
avc:  denied  { setattr } for  pid=548 comm="rsyslogd" name="log" dev=sda1 ino=131515 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:postfix_spool_t:s0 tclass=sock_file

I think the issue is because /var/spool/postfix/dev/log is not properly labelled in the policy. I will attach a untested patch
to that bug report.
#707293#10
Date:
2013-05-08 20:43:44 UTC
From:
To:
#707293#19
Date:
2013-08-08 16:11:40 UTC
From:
To:
Hi,

as mentioned in the wiki, the debian default configuration of postfix
(chrooted) is not supported by selinux policy. Please use the script
postfix-nochroot to unchroot your configuration.

Cheers,

Mika
#707293#22
Date:
2013-08-08 16:11:40 UTC
From:
To:
Hi,

as mentioned in the wiki, the debian default configuration of postfix
(chrooted) is not supported by selinux policy. Please use the script
postfix-nochroot to unchroot your configuration.

Cheers,

Mika
#707293#27
Date:
2013-08-10 19:27:24 UTC
From:
To:
Le jeudi 08 août 2013 à 18:11 +0200, Mika Pflüger a écrit :

Hi,

Well, besides the patch I sent, the only missing part in selinux policy
is something to fix this :

type=AVC msg=audit(1375791086.840:4461): avc:  denied  { sys_chroot }
for  pid=23706 comm="pickup" capability=18
scontext=system_u:system_r:postfix_pickup_t:s0
tcontext=system_u:system_r:postfix_pickup_t:s0 tclass=capability

So i think integrating my patch would help to work toward a fix. There
is no reason to apply this only on redhat based distribution, so the
patch seems harmless to enable in unstable.