0

I have installed and configured postfix to use ssl certifcates for sending external mail via a relay. This setup has worked on several other Ubuntu/Centos machines. I have my certificates in:

/etc/ssl/certs/

and my postfix setup is as usual in:

/etc/postfix

the crucial line in main.cf is:

smtp_tls_CAfile = /etc/ssl/certs/AddTrustExternalCARoot.crt

When I start postfix I get an error in the maillog:

Mar 17 11:55:36 clarity postfix/smtp[14878]: cannot load Certificate Authority data: disabling TLS support

Mar 17 11:55:36 clarity postfix/smtp[14878]: warning: TLS library problem: 14878:error:0200100D:system library:fopen:Permission denied:bss_file.c:169:fopen('/etc/ssl/certs/AddTrustExternalCARoot.crt','r'):

Mar 17 11:55:36 clarity postfix/smtp[14878]: warning: TLS library problem: 14878:error:2006D002:BIO routines:BIO_new_file:system lib:bss_file.c:174:

Mar 17 11:55:36 clarity postfix/smtp[14878]: warning: TLS library problem: 14878:error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib:by_file.c:279:

This led me to the SELinux audit log, where I see:

type=AVC msg=audit(1489751736.280:1341): avc: denied { read } for pid=14878 comm="smtp" name="AddTrustExternalCARoot.crt" dev=dm-0 ino=2228876 scontext=unconfined_u:system_r:postfix_smtp_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file

So I tried to follow instructions here to create a new policy allowing the reading of the cert in it's default location. Unfortunately it still didn't work, same error(s). I moved the cert to the postfix config directory /etc/postfix, updated main.cf, restarted postfix and now all is good. My question is how should I have created an SELinux policy to allow postfix to read certificates installed outside it's config directory?

Thanks

Improve this question

1 Answer 1

Reset to default
2

I would suggest you to run restorecon -Rv /etc/ssl/ on the machine.

It seems that you have moved the file from your home directory without restoring the file context as you can see in the denial

Improve this answer
3
  • This didn't actually fix my problem but +1 for putting me on the right track chcon -u system_u -t bin_t AddTrustExternalCARoot.crt sorted out the file to mirror other certs in the directory. You were right that the file was originally copied from /home/* Thanks
    – slowko
    Mar 17, 2017 at 16:00
  • IMHO, the context for that file should be system_u:object_r:cert_t:s0 not bin_t. bin_t is for executable files
    – Bigon
    Mar 17, 2017 at 16:32
  • Again, thanks. I rushed and checked (ls -Z) the wrong (type of) file. Changing to t_cert also works and is, as you say, more appropriate.
    – slowko
    Mar 17, 2017 at 16:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .