 |
Seems reproductible on a fresh updated install. Standard users can send mails, that doesn't trigger the event. But mails send from crontab generate the issue. Could be redondant with that report ID where I already added some findings: https://bugs.centos.org/view.php?id=12396 To solve my crontab and mail issue, seems I would need to add following rule: allow system_mail_t sysctl_net_t:file open; Additionnaly, I noticed ausearch is bogus (adds garbage at EOL), as described in: https://bugzilla.redhat.com/show_bug.cgi?id=1408248 |
|
|
And I now noticed also following event, triggered by my mails, sent by crontab: setroubleshoot[16623]: failed to retrieve rpm info for /proc/sys/net/ipv6/conf/all/disable_ipv6 |
|
|
Now I patched it using following own "mypolicy.te". "open" wasn't enough, triggered "SELinux is preventing /usr/sbin/sendmail.sendmail from getattr access on the file". So I added "getattr open read". Now my crontab sends out mails without selinu/disable_ipv6 file complains... # cat mypolicy.te module mypolicy 1.0; require { type sendmail_t; type sysctl_net_t; type system_mail_t; class file { getattr open read }; class dir search; } allow system_mail_t sysctl_net_t:file { getattr open read }; # checkmodule -M -m -o mypolicy.mod mypolicy.te checkmodule: loading policy configuration from mypolicy.te checkmodule: policy configuration loaded # semodule_package -m mypolicy.mod -o mypolicy.pp # semodule -i mypolicy.pp |
|
|
Same thing here: type=AVC msg=audit(1549609502.331:2251207): avc: denied { search } for pid=25846 comm="sendmail" name="net" dev="proc" ino=51427866 scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir type=AVC msg=audit(1549609502.331:2251207): avc: denied { read } for pid=25846 comm="sendmail" name="disable_ipv6" dev="proc" ino=51427870 scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file type=AVC msg=audit(1549609502.331:2251207): avc: denied { open } for pid=25846 comm="sendmail" path="/proc/sys/net/ipv6/conf/all/disable_ipv6" dev="proc" ino=51427870 scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file type=AVC msg=audit(1549609502.332:2251208): avc: denied { getattr } for pid=25846 comm="sendmail" path="/proc/sys/net/ipv6/conf/all/disable_ipv6" dev="proc" ino=51427870 scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file |
- Anonymous
