I have installed and configured postfix to use ssl certifcates for sending external mail via a relay. This setup has worked on several other Ubuntu/Centos machines. I have my certificates in:
/etc/ssl/certs/
and my postfix setup is as usual in:
/etc/postfix
the crucial line in main.cf is:
smtp_tls_CAfile = /etc/ssl/certs/AddTrustExternalCARoot.crt
When I start postfix I get an error in the maillog:
Mar 17 11:55:36 clarity postfix/smtp[14878]: cannot load Certificate Authority data: disabling TLS support
Mar 17 11:55:36 clarity postfix/smtp[14878]: warning: TLS library problem: 14878:error:0200100D:system library:fopen:Permission denied:bss_file.c:169:fopen('/etc/ssl/certs/AddTrustExternalCARoot.crt','r'):
Mar 17 11:55:36 clarity postfix/smtp[14878]: warning: TLS library problem: 14878:error:2006D002:BIO routines:BIO_new_file:system lib:bss_file.c:174:
Mar 17 11:55:36 clarity postfix/smtp[14878]: warning: TLS library problem: 14878:error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib:by_file.c:279:
This led me to the SELinux audit log, where I see:
type=AVC msg=audit(1489751736.280:1341): avc: denied { read } for pid=14878 comm="smtp" name="AddTrustExternalCARoot.crt" dev=dm-0 ino=2228876 scontext=unconfined_u:system_r:postfix_smtp_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
So I tried to follow instructions here to create a new policy allowing the reading of the cert in it's default location. Unfortunately it still didn't work, same error(s). I moved the cert to the postfix config directory /etc/postfix
, updated main.cf, restarted postfix and now all is good. My question is how should I have created an SELinux policy to allow postfix to read certificates installed outside it's config directory?
Thanks