-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 01/05/2011 11:50 AM, Paul Johnson wrote:
> I quit using Fedora a couple of years ago, largely because I felt as
> though I was being used as an SELinux guinea pig. I spent days and
> says trying to work around selinux problems, until I eventually just
> turned it off.
>
> I'm not a professional sysadmin, but I know many of them who think
> SELinux is still just not workable enough for actual production
> systems.
>
> I just installed the release version of RedHat 6 and wanted to use
> mediawiki and a couple of other CGI php programs. All of those
> programs that require email capability via sendmail/postfix do not
> work with SELINUX turned on. Some programs are nice enough to pop up
> a "sendmail failed" message, but not all.
>
> type=USER_CMD msg=audit(1293752457.837:246): user pid=4383 uid=0
> auid=500 ses=9 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> msg='cwd="/var/www/mediawiki116"
> cmd=2F62696E2F7669204C6F63616C53657474696E67732E706870 terminal=pts/4
> res=success'
> type=AVC msg=audit(1293752692.348:247): avc: denied { search } for
> pid=4583 comm="sendmail" name="postfix" dev=sda2 ino=150564
> scontext=unconfined_u:system_r:httpd_t:s0
> tcontext=system_u:object_r:postfix_spool_t:s0 tclass=dir
> type=SYSCALL msg=audit(1293752692.348:247): arch=c000003e syscall=80
> success=no exit=-13 a0=7f44c0011cc0 a1=7f44c0013a00 a2=7f44c001827d
> a3=7fff104b7710 items=0 ppid=4410 pid=4583 auid=500 uid=48 gid=48
> euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=9
> comm="sendmail" exe="/usr/sbin/sendmail.postfix"
> subj=unconfined_u:system_r:httpd_t:s0 key=(null)
>
> It is a known bugzilla, there's supposed to be some fix in the way,
> but it has turned into such a big hassle for us here that we've turned
> selinux down to PERMISSIVE mode, just so things will work.
>
> SELINUX generates such a massive amount of output in /var/log/audit
> that I would never be able to notice what fails and what doesnt, some
> programs silently die with SELINUX rejects them. For example, I
> created a bunch of accounts in mediawiki that require email
> confirmation. Use of sendmail was rejected, (silently), and so the
> users's can't log in. Grrr.
>
>
>
Turn on the httpd_can_sendmail boolean. We do not want all apache
servers to be able to send mail by default.
# setsebool -P httpd_can_sendmail 1
man apache_selinux
...
SELinu policy for httpd can be configured to turn on sending
email.
This is a security feature, since it would prevent a
vulnerabiltiy in
http from causing a spam attack. I certain situations, you may
want
http modules to send mail. You can turn on the httpd_send_mail
bool?
ean.
setsebool -P httpd_can_sendmail 1
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk0kvvwACgkQrlYvE4MpobMNgACeNILc8S4gRo70rwyWLgTc7+D7
b8YAnRsl4HZhAcKMAqly/BsemG6EipP/
=WvAc
-----END PGP SIGNATURE-----