[CentOS] Apache php and exim

Lazy

lazy404 at gmail.com
Wed Jun 7 15:19:11 UTC 2006


Hello,
I'm using the targeted policy.
PHP's mail() function fails because of selinux.

audit(1149662369.454:2): avc:  denied  { setgid } for  pid=18085
comm="sendmail" capability=6 scontext=root:system_r:httpd_sys_script_t
tcontext=root:system_r:httpd_sys_script_t tclass=capability

When i turn to permisive mode:
audit(1149668677.105:12): avc:  denied  { setuid } for  pid=29159
comm="sendmail" capability=7 scontext=root:system_r:ht
tpd_sys_script_t tcontext=root:system_r:httpd_sys_script_t tclass=capability
audit(1149668677.157:13): avc:  denied  { dac_override } for
pid=29159 comm="sendmail" capability=1 scontext=root:syste
m_r:httpd_sys_script_t tcontext=root:system_r:httpd_sys_script_t
tclass=capability
audit(1149668677.209:14): avc:  denied  { write } for  pid=29159
comm="sendmail" name="input" dev=dm-3 ino=1335707 scont
ext=root:system_r:httpd_sys_script_t
tcontext=system_u:object_r:var_spool_t tclass=dir
audit(1149668677.209:15): avc:  denied  { add_name } for  pid=29159
comm="sendmail" name="1FntLB-0007aJ-6i-D" scontext=r
oot:system_r:httpd_sys_script_t tcontext=system_u:object_r:var_spool_t
tclass=dir

Maybe there should be a context change to some mta specific context
diuring the execution of /usr/sbin/sendmail.

ls -Z /usr/zbin
-rwsr-xr-x  root     root     system_u:object_r:sbin_t         /usr/sbin/exim
lrwxrwxrwx  root     root     root:object_r:sbin_t
/usr/sbin/sendmail -> /etc/alternatives/mta
lrwxrwxrwx  root     root     system_u:object_r:sbin_t
/usr/sbin/sendmail.exim -> exim

Maybe exim shuld be sendmail_exec_t ?

I can't experiment now. Will try setting it later.

Can anyone give me some guaidance ?



More information about the CentOS mailing list