1

I've setup an application called altermime (http://www.pldaniels.com/altermime/) for postfix (SMTP server) which alters emails midstream. I'm injecting a "X-ListUnsubscribe" header into every email message sent from our server for spam reasons.

Altermime needs to be able to write to /var/spool/filter (normally I think postfix writes to /var/spool/postfix). Anyway this all works fine with SELinux disabled but with it enabled it breaks.

As tempting as it might be to simply turn off SELinux and be done with it, I'd rather not compromise the security of my box in that manner. So I'm trying to modify SELinux to so that writing to /var/spool/filter is allowed.

I've tried:

 cat /var/log/audit/audit.log | audit2why 

Which shows me the exceptions (I'll include them below).

And I've done this multiple times:

 audit2allow -M altermime < /var/log/audit/audit.log
 semodule -i altermime.pp

However that doesn't seem to work. I'm assuming it may be because the audit2allow is naming individual files (/var/spool/filter/xxxx) being blocked vs the entire directory (/var/spool/filter/*). I can't figure out how to create a policy or change SELinux to allow access.

Here is an excerpt of my audit2why:

type=AVC msg=audit(1409231063.712:263024): avc:  denied  { add_name } for  pid=21280 comm="disclaimer" name="in.21279" scontext=unconfined_u:system_r:postfix_pipe_t:s0 tcontext=unconfined_u:object_r:var_spool_t:s0 tclass=dir
    Was caused by:
            Missing type enforcement (TE) allow rule.
            You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1409231065.905:263025): avc:  denied  { add_name } for  pid=21285 comm="disclaimer" name="in.21284" scontext=unconfined_u:system_r:postfix_pipe_t:s0 tcontext=unconfined_u:object_r:var_spool_t:s0 tclass=dir
    Was caused by:
            Missing type enforcement (TE) allow rule.
            You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1409231067.380:263026): avc:  denied  { add_name } for  pid=21289 comm="disclaimer" name="in.21288" scontext=unconfined_u:system_r:postfix_pipe_t:s0 tcontext=unconfined_u:object_r:var_spool_t:s0 tclass=dir
    Was caused by:
            Missing type enforcement (TE) allow rule.
            You can use audit2allow to generate a loadable module to allow this access.
  • When I do an ls -alZ I get the following for the filter directory: drwxr-x---. filter filter system_u:object_r:postfix_spool_t:s0 filter – Brad Aug 28 '14 at 13:27
1

I'm going to answer my own question. First I did the following:

semodule -l | grep mymodulename

(Replace mymodulename with any previous modules you may have imported). Skip this step if you haven't previously imported any modules.

Then run this command to remove any previously imported modules. Again skip this step if you haven't imported any previous modules.

semodule -r names_of_modules_returned_from_prior_command

We should now be back at a "clean" slate.

Next run the following to set selinux to permissive (monitor/log but don't block):

setenforce 0

Do getenforce and make sure it returns: permissive

Run the following command to clear the SELinux log:

echo "" >/var/log/audit.log

WAIT AT LEAST 15-20 minutes for selinux to create new log entries in /var/log/audit/audit.log

Then run the following command to create a comprehensive selinux policy:

cat /var/log/audit/audit.log | audit2allow -m yourname >yourname.te

Then run the following command which I believe checks the .te file and creates a .mod file(?)

checkmodule -M -m -o yourname.mod yourname.te

Next compile the .mod file into a binary .pp file with the following command:

 semodule_package -m yourname.mod  -o yourname.pp

Finally install the module:

 semodule -i yourname.pp

Monitor the /var/log/audit/audit.log for awhile and ensure no new entries show up.

cat /var/log/audit/audit.log | audit2why

If no new entries show up set selinux back to enforcing:

setenforce 1

That seemed to work for me. It may be a bit more permissive than needed but at least I'm not turning SELinux off entirely.

Hopefully this helps someone else.

Thanks Brad

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.