Hi All,
I'm running CentOS 5.2 with SELinux in enforcing mode (default
targeted policy). The server hosts a PHP web app that sends mail. I'm
getting the following errors (see end of message) in my selinux
audit.log file every time the app sends an email. The email always
seems to get sent successfully, despite the log messages. However,
they do concern me and I would like to understand what they mean and
why they occur.
The first set of messages seems to relate to postfix being denied
attempts to create/read/write a temporary file in Apache's context. In
the second set, it seems to postdrop is attempting to do something
with apache's error log file.
Can anyone help make sense of this? I know I can create policy rules
to allow these actions. But I don't want to do that without
understanding the implications. For reference, audit2allow suggests
the following policy additions:
#============= postfix_postdrop_t ==============
allow postfix_postdrop_t httpd_log_t:file getattr;
#============= system_mail_t ==============
allow system_mail_t httpd_t:file read;
allow system_mail_t httpd_tmp_t:file { read write };
Any help greatly appreciated.
Thanks!
Sam
-------------------------------------------------------------------------------------------
type=AVC msg=audit(1219458556.400:16996): avc: denied { read write }
for pid=xxxxx comm="sendmail"
path=2F746D702F2E7863616368652E302E302E313236373935383634322E6C6F636B202864656C6574656429
dev=dm-1 ino=xxxxx scontext=user_u:system_r:system_mail_t:s0
tcontext=user_u:object_r:httpd_tmp_t:s0 tclass=file
type=AVC msg=audit(1219458556.400:16996): avc: denied { read write }
for pid=xxxxx comm="sendmail"
path=2F746D702F2E7863616368652E302E312E3534383639343233352E6C6F636B202864656C6574656429
dev=dm-1 ino=xxxxx scontext=user_u:system_r:system_mail_t:s0
tcontext=user_u:object_r:httpd_tmp_t:s0 tclass=file
type=AVC msg=audit(1219458556.400:16996): avc: denied { read write }
for pid=xxxxx comm="sendmail"
path=2F746D702F2E7863616368652E302E322E313236323334313837332E6C6F636B202864656C6574656429
dev=dm-1 ino=xxxxx scontext=user_u:system_r:system_mail_t:s0
tcontext=user_u:object_r:httpd_tmp_t:s0 tclass=file
type=AVC msg=audit(1219458556.400:16996): avc: denied { read write }
for pid=xxxxx comm="sendmail"
path=2F746D702F2E7863616368652E302E332E32313137303238332E6C6F636B202864656C6574656429
dev=dm-1 ino=xxxxx scontext=user_u:system_r:system_mail_t:s0
tcontext=user_u:object_r:httpd_tmp_t:s0 tclass=file
type=AVC msg=audit(1219458556.400:16996): avc: denied { read } for
pid=xxxxx comm="sendmail" path="eventpoll:[xxxxx]" dev=eventpollfs
ino=xxxxx scontext=user_u:system_r:system_mail_t:s0
tcontext=user_u:system_r:httpd_t:s0 tclass=file
type=SYSCALL msg=audit(1219458556.400:16996): arch=c000003e syscall=59
success=yes exit=0 a0=e04360 a1=e043e0 a2=e031a0 a3=3 items=0
ppid=xxxxx pid=xxxxx auid=xxx uid=xxx gid=xxx euid=xxx suid=xxx
fsuid=xxx egid=xxx sgid=xxx fsgid=xxx tty=(none) ses=1363
comm="sendmail" exe="/usr/sbin/sendmail.postfix"
subj=user_u:system_r:system_mail_t:s0 key=(null)
type=AVC msg=audit(1219458556.410:16997): avc: denied { getattr }
for pid=xxxxx comm="postdrop" path="/var/log/httpd/error_log"
dev=dm-4 ino=xxxxx scontext=user_u:system_r:postfix_postdrop_t:s0
tcontext=user_u:object_r:httpd_log_t:s0 tclass=file
type=SYSCALL msg=audit(1219458556.410:16997): arch=c000003e syscall=5
success=no exit=-13 a0=2 a1=7fffd0dbfa70 a2=7fffd0dbfa70 a3=0 items=0
ppid=xxxxx pid=xxxxx auid=xxx uid=xxx gid=xxx euid=xxx suid=xxx
fsuid=xxx egid=xxx sgid=xxx fsgid=xxx tty=(none) ses=1363
comm="postdrop" exe="/usr/sbin/postdrop"
subj=user_u:system_r:postfix_postdrop_t:s0 key=(null)
-------------------------------------------------------------------------------------------