On 26 Apr 2015, at 0:26, E.B. wrote:
People with selinux knowledge I very really appreciate your
advice!!.....
Trying to restart postfix installed from yum in Centos 7. Restart
fails, I get:
type=AVC msg=audit(1430429813.721:12167): avc: denied { unlink } for
pid=31624 comm="master" name="defer" dev="dm-0" ino=981632
scontext=system_u:system_r:postfix_master_t:s0
tcontext=system_u:object_r:postfix_spool_maildrop_t:s0
tclass=sock_file
I guess it needs to remove the /var/spool/postfix/private/defer socket
file.
audit2allow says this will fix it:
allow postfix_master_t postfix_spool_maildrop_t:sock_file unlink;
But how do I add this permission to the existing Postfix Selinux
policy???
See the man pages for audit2allow, semodule, checkmodule,
postfix_selinux and semanage. The first provides a complete run-through
of how to adapt your local policies from your audit logs, but it is
useful to understand the others as well.
Why was it missing???
That's a question for RedHat. They maintain the default SELinux policies
that are distributed with CentOS.
By the way, I also had AVCs when I tried to add another instance of
Postfix smtpd on local port 20025. Very frustrating there is no docs
how to add a rule for this common change.
There are, and it seems you've found them and used them in this case.
The man pages for the SELinux tools don't provide copy+paste scripts for
how to do common non-standard things for Postfix, but they do explain
the functions of those tools.
I don't know if I did the
right thing:
semanage port -a -t smtp_port_t -p tcp 20025
Is this the right way?
That seems to me the most reasonable tweak to run a second smtpd on
20025. If it does what you need on your system, it's right for you.
Why isn't this documented somewhere?
It is. See above.
If you're going to run a system with SELinux in enforcing mode, you
really should read the available documentation and be prepared to
*invent* local adaptations to the baseline policies to fit your local
requirements. Once you start diverging from the config that was used in
developing the default policies you risk running into them, which is
proper: SELinux is intended to be a straitjacket on a system.
