<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Ok, but how? <div><br></div><div>There appear to be a lot of different options when employing audit2allow and I am reluctant to start blazing away trying different elements. I am missing the details of what socket an dhow the execution is occuring so that I can begin to develop the proper audit2allow sequence.<div><br></div><div><br><div><br></div><div><br><div><div>On Apr 30, 2009, at 8:43 AM, Andrew Colin Kissa wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Hi</div><div><br></div><div>Dovecot is trying to open a socket, and procmail is trying to execute spamc, You should be able to fix these issues using audit2allow.</div><div><br></div><div>Andrew.</div><br><div><div>On 30 Apr 2009, at 4:07 PM, Dan Roberts wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Following a hard drive corruption I have reinstalled the latest version of CentOS and all current patch files.<div><br></div><div>For most applications I selected the default options. By doing this I expected that the packages would play nice with one another and I could customize as necessary.</div><div><br></div><div>Setting SELinux to enforce I encountered all sorts of problems - but most were resolvable, save for Dovecot, Procmail (for spamc), and an odd one with Apache.</div><div><br></div><div>Given that these were all installed with the CentOS install defaults, I can't believe I am the only one with these issues but finding a solution has not been self evident. Hoping someone here can help.</div><div><br></div><div>For Dovecot I get the following:</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>SELinux is preventing dovecot (dovecot_t) "create" to <Unknown> (dovecot_t). For complete SELinux messages. run sealert -l e1b070ab-586a-4c5a-befe-b6a46b9ab992</div><div><br></div><div>For procmail I get the following:</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>SELinux is preventing procmail (procmail_t) "execute" to ./spamc (spamc_exec_t). For complete SELinux messages. run sealert -l 0a554689-4948-4edf-9964-dddbfe6a2492</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>SELinux is preventing sh (procmail_t) "read" to ./spamc (spamc_exec_t). For complete SELinux messages. run sealert -l 1f1ebd83-412d-4e93-a36f-6f3d34c663df</div><div><br></div><div>For Apache it's even more strange - When started I get:</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Syntax error on line 283 of /etc/httpd/conf/httpd.conf</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>DocumentRoot must be directory</div><div><br></div><div>But it is a directory, has the correct permissions and I have even run chcon -R -h -t httpd_sys_content_t /web/www/ in an effort to correct the problem. I run a virtual server too, and in trying to find a fix for this that may be a problem - but first things first.</div><div><br></div><div>All the other issues I had I could resolve when I ran the specified "sealert" tag and followed the suggested instructions - but those above don't budge. When I go to the fedora.redhat.com/docs/selinux-fq-fc5 site to take on making a local policy module I am quickly getting lost . The option to simply disable SElinux with respect to Apache, Dovecote or anything else is suggested - but not something I see in the GUI window, and I have not figured out how to do it from the command line.</div><div><br></div><div>Again, because these are default packages, I hope that someone else knows how to resolve these.</div><div><br></div><div>With respect to the to reports from SELinux regarding Dovecot and promail, here is a bit more info: </div><div><br></div><div>The info and Raw Audit message for dovecot_t is:</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Source Context<span style="mso-spacerun: yes"> </span>system_u:system_r:dovecot_t:s0</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Target Context<span style="mso-spacerun: yes"> </span>system_u:system_r:dovecot_t:s0</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Target Objects<span style="mso-spacerun: yes"> </span>None [ socket ]</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Source<span style="mso-spacerun: yes"> </span>dovecot</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Source Path<span style="mso-spacerun: yes"> </span>/usr/sbin/dovecot</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Port<span style="mso-spacerun: yes"> </span><Unknown></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Host<span style="mso-spacerun: yes"> </span>trailrunner</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Source RPM Packages<span style="mso-spacerun: yes"> </span>dovecot-1.0.7-7.el5</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Target RPM Packages<span style="mso-spacerun: yes"> </span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Policy RPM<span style="mso-spacerun: yes"> </span>selinux-policy-2.4.6-203.el5</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Selinux Enabled<span style="mso-spacerun: yes"> </span>True</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Policy Type<span style="mso-spacerun: yes"> </span>targeted</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>MLS Enabled<span style="mso-spacerun: yes"> </span>True</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Enforcing Mode<span style="mso-spacerun: yes"> </span>Enforcing</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Plugin Name<span style="mso-spacerun: yes"> </span>catchall</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Host Name<span style="mso-spacerun: yes"> </span>trailrunner</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Platform<span style="mso-spacerun: yes"> </span>Linux trailrunner 2.6.18-128.1.6.el5xen #1 SMP Wed<span style="mso-spacerun: yes"></span></span></div><div><span style="mso-spacerun: yes"><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span> </span>Apr 1 10:38:05 EDT 2009 i686 athlon</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Alert Count<span style="mso-spacerun: yes"> </span>2</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>First Seen<span style="mso-spacerun: yes"> </span>Wed Apr 29 15:39:51 2009</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Last Seen<span style="mso-spacerun: yes"> </span><span style="mso-spacerun: yes"> </span>Wed Apr 29 15:47:31 2009</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Local ID<span style="mso-spacerun: yes"> </span>e1b070ab-586a-4c5a-befe-b6a46b9ab992</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Line Numbers<span style="mso-spacerun: yes"> </span></span></div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Raw Audit Messages<br></div><div><span class="Apple-style-span" style="font-family: verdana; font-size: 13px; "><font class="Apple-style-span" face="Helvetica" size="3"><span class="Apple-tab-span" style="white-space:pre"> </span>host=trailrunner type=AVC msg=audit(1241041651.976:33): avc:</font><span style="mso-spacerun: yes"><font class="Apple-style-span" face="Helvetica" size="3"> </font></span><font class="Apple-style-span" face="Helvetica" size="3">denied</font><span style="mso-spacerun: yes"><font class="Apple-style-span" face="Helvetica" size="3"> </font></span><font class="Apple-style-span" face="Helvetica" size="3">{ create } for</font><span style="mso-spacerun: yes"><font class="Apple-style-span" face="Helvetica" size="3"> </font></span><font class="Apple-style-span" face="Helvetica" size="3">pid=3884 comm="dovecot" scontext=system_u:system_r:dovecot_t:s0 tcontext=system_u:system_r:dovecot_t:s0 tclass=socket</font></span></div><div><span class="Apple-style-span" style="font-family: verdana; font-size: 13px; "><font class="Apple-style-span" face="Helvetica" size="3"><span class="Apple-tab-span" style="white-space:pre"> </span>host=trailrunner type=SYSCALL msg=audit(1241041651.976:33): arch=40000003 syscall=102 success=no exit=-13 a0=1 a1=bf851070 a2=9e45030 a3=3e1 items=0 ppid=3883 pid=3884 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dovecot" exe="/usr/sbin/dovecot" subj=system_u:system_r:dovecot_t:s0 key=(null)</font></span></div><div><br></div><div>The Raw Audit Message for Procmail is:</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Source Context<span style="mso-spacerun: yes"> </span>system_u:system_r:procmail_t:s0</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Target Context<span style="mso-spacerun: yes"> </span>system_u:object_r:spamc_exec_t:s0</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Target Objects<span style="mso-spacerun: yes"> </span>./spamc [ file ]</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Source<span style="mso-spacerun: yes"> </span>procmail</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Source Path<span style="mso-spacerun: yes"> </span>/usr/bin/procmail</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Port<span style="mso-spacerun: yes"> </span><Unknown></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Host<span style="mso-spacerun: yes"> </span>trailrunner</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Source RPM Packages<span style="mso-spacerun: yes"> </span>procmail-3.22-17.1.el5.centos</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Target RPM Packages<span style="mso-spacerun: yes"> </span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Policy RPM<span style="mso-spacerun: yes"> </span>selinux-policy-2.4.6-203.el5</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Selinux Enabled<span style="mso-spacerun: yes"> </span>True</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Policy Type<span style="mso-spacerun: yes"> </span><span style="mso-spacerun: yes"> </span>targeted</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>MLS Enabled<span style="mso-spacerun: yes"> </span>True</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Enforcing Mode<span style="mso-spacerun: yes"> </span>Enforcing</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Plugin Name<span style="mso-spacerun: yes"> </span>catchall_file</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Host Name<span style="mso-spacerun: yes"> </span>trailrunner</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Platform<span style="mso-spacerun: yes"> </span>Linux trailrunner 2.6.18-128.1.6.el5xen #1 SMP Wed<span style="mso-spacerun: yes"></span></span></div><div><span style="mso-spacerun: yes"><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span> </span>Apr 1 10:38:05 EDT 2009 i686 athlon</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Alert Count<span style="mso-spacerun: yes"> </span>29</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>First Seen<span style="mso-spacerun: yes"> </span>Wed Apr 29 15:40:40 2009</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Last Seen<span style="mso-spacerun: yes"> </span>Wed Apr 29 16:25:40 2009</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Local ID<span style="mso-spacerun: yes"> </span>0a554689-4948-4edf-9964-dddbfe6a2492</span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>Line Numbers<span style="mso-spacerun: yes"> </span></span></div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Raw Audit Messages<span style="mso-spacerun: yes"> </span></div><div><span style="mso-spacerun: yes"><span class="Apple-tab-span" style="white-space:pre"> </span>host=trailrunner type=AVC msg=audit(1241043940.918:166): avc:<span style="mso-spacerun: yes"> </span>denied<span style="mso-spacerun: yes"> </span>{ execute } for<span style="mso-spacerun: yes"> </span>pid=3344 comm="procmail" name="spamc" dev=dm-0 ino=18762675 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:spamc_exec_t:s0 tclass=file</span></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>host=trailrunner type=SYSCALL msg=audit(1241043940.918:166): arch=40000003 syscall=11 success=no exit=-13 a0=8ef1d90 a1=8ef1020 a2=8ef32d8 a3=1 items=0 ppid=3343 pid=3344 auid=4294967295 uid=0 gid=12 euid=0 suid=0 fsuid=0 egid=12 sgid=12 fsgid=12 tty=(none) ses=4294967295 comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)</div><div><p class="MsoNormal"><o:p> </o:p></p><p class="MsoNormal"><o:p> </o:p></p><p class="MsoNormal"><o:p> </o:p></p> <!--EndFragment--> </div><div><br></div></div>_______________________________________________<br>CentOS mailing list<br><a href="mailto:CentOS@centos.org">CentOS@centos.org</a><br><a href="http://lists.centos.org/mailman/listinfo/centos">http://lists.centos.org/mailman/listinfo/centos</a><br></blockquote></div><br></div>_______________________________________________<br>CentOS mailing list<br><a href="mailto:CentOS@centos.org">CentOS@centos.org</a><br>http://lists.centos.org/mailman/listinfo/centos<br></blockquote></div><br></div></div></div></body></html>