Am 26.04.2015 um 06:22 schrieb E.B.:

Trying to restart postfix installed from yum. Restart fails, I get:

type=AVC msg=audit(1430429813.721:12167): avc: denied { unlink } for pid=31624 comm="master" name="defer" dev="dm-0" ino=981632 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:postfix_spool_maildrop_t:s0 tclass=sock_file

I guess it needs to remove the /var/spool/postfix/defer socket file.

audit2allow says this will fix it:

allow postfix_master_t postfix_spool_maildrop_t:sock_file unlink;

But how do I add this permission to the existing Postfix Selinux policy??? Why was it missing???

Multiple question marks are not necessary.

You missed to tell us which precise CentOS release you are running and which version of Postfix.

On my CentOS 6.6 the defer socket has SELinux type different than yours:

# ls -alZ /var/spool/postfix/private/defer srw-rw-rw-. postfix postfix system_u:object_r:postfix_private_t:s0 /var/spool/postfix/private/defer

By the way, I also had AVCs when I tried to add another instance of Postfix smtpd on local port 20025. Very frustrating there is no docs how to add a rule for this common change. I don't know if I did the right thing:

semanage port -a -t smtp_port_t -p tcp 20025

Is this the right way? Why isn't this documented somewhere?

That's well documented .

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/htm...