Hello,

I have deployed Bugzilla 3.6.2 on CentOS 5 (with rpmforge perl-* packages) and I have a problem with SELinux preventing mail being sent via sendmail. (see SELinux reports below, especially the second one)

When SELinux is in permissive mode, mail sending from Bugzilla is working properly.

Has anybody got recent Bugzilla to work with SELinux on CentOS?

Thanks in advance!

Mathieu

--------------------------------------------------------------------------------

Summary:

SELinux is preventing the sendmail from using potentially mislabeled files ./spool (var_spool_t).

Detailed Description:

SELinux has denied the sendmail access to potentially mislabeled files ./spool. This means that SELinux will not allow httpd to use these files. Many third party apps install html files in directories that SELinux policy cannot predict. These directories have to be labeled with a file context which httpd can access.

Allowing Access:

If you want to change the file context of ./spool so that the httpd daemon can access it, you need to execute it using chcon -t httpd_sys_content_t './spool'. You can look at the httpd_selinux man page for additional information.

Additional Information:

Source Context system_u:system_r:httpd_bugzilla_script_t Target Context system_u:object_r:var_spool_t Target Objects ./spool [ dir ] Source sendmail Source Path /usr/sbin/sendmail.sendmail Port <Unknown> Host <Unknown> Source RPM Packages sendmail-8.13.8-8.el5 Target RPM Packages Policy RPM selinux-policy-2.4.6-279.el5_5.1 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name httpd_bad_labels Host Name www Platform Linux www 2.6.18-194.11.4.el5 #1 SMP Tue Sep 21 05:04:09 EDT 2010 x86_64 x86_64 Alert Count 1 First Seen Mon Sep 27 02:07:43 2010 Last Seen Mon Sep 27 02:07:43 2010 Local ID 24372577-2d4c-4bbe-be6b-ea9100b7c3ed Line Numbers 11701, 11702

Raw Audit Messages

type=AVC msg=audit(1285546063.60:15): avc: denied { search } for pid=3420 comm="sendmail" name="spool" dev=dm-2 ino=158722 scontext=system_u:system_r:httpd_bugzilla_script_t:s0 tcontext=system_u:object_r:var_spool_t:s0 tclass=dir

type=SYSCALL msg=audit(1285546063.60:15): arch=c000003e syscall=80 success=no exit=-13 a0=7fffeddf6060 a1=17 a2=fff a3=0 items=0 ppid=3418 pid=3420 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=51 sgid=51 fsgid=51 tty=(none) ses=4294967295 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:httpd_bugzilla_script_t:s0 key=(null)

--------------------------------------------------------------------------------

Summary:

SELinux is preventing sendmail (httpd_bugzilla_script_t) "create" to <Unknown> (httpd_bugzilla_script_t).

Detailed Description:

SELinux denied access requested by sendmail. It is not expected that this access is required by sendmail and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package.

Additional Information:

Source Context system_u:system_r:httpd_bugzilla_script_t Target Context system_u:system_r:httpd_bugzilla_script_t Target Objects None [ unix_dgram_socket ] Source sendmail Source Path /usr/sbin/sendmail.sendmail Port <Unknown> Host <Unknown> Source RPM Packages sendmail-8.13.8-8.el5 Target RPM Packages Policy RPM selinux-policy-2.4.6-279.el5_5.1 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name www Platform Linux www 2.6.18-194.11.4.el5 #1 SMP Tue Sep 21 05:04:09 EDT 2010 x86_64 x86_64 Alert Count 1 First Seen Mon Sep 27 02:07:43 2010 Last Seen Mon Sep 27 02:07:43 2010 Local ID f7aa29e4-40d9-4184-904e-4dfb93c57ea7 Line Numbers 11703, 11704

Raw Audit Messages

type=AVC msg=audit(1285546063.61:16): avc: denied { create } for pid=3420 comm="sendmail" scontext=system_u:system_r:httpd_bugzilla_script_t:s0 tcontext=system_u:system_r:httpd_bugzilla_script_t:s0 tclass=unix_dgram_socket

type=SYSCALL msg=audit(1285546063.61:16): arch=c000003e syscall=41 success=no exit=-13 a0=1 a1=2 a2=0 a3=7373696d72655020 items=0 ppid=3418 pid=3420 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=51 sgid=51 fsgid=51 tty=(none) ses=4294967295 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:httpd_bugzilla_script_t:s0 key=(null)