I have installed and configured postfix to use ssl certifcates for sending external mail via a relay. This setup has worked on several other Ubuntu/Centos machines. I have my certificates in:


and my postfix setup is as usual in:


the crucial line in main.cf is:

smtp_tls_CAfile = /etc/ssl/certs/AddTrustExternalCARoot.crt

When I start postfix I get an error in the maillog:

Mar 17 11:55:36 clarity postfix/smtp[14878]: cannot load Certificate Authority data: disabling TLS support

Mar 17 11:55:36 clarity postfix/smtp[14878]: warning: TLS library problem: 14878:error:0200100D:system library:fopen:Permission denied:bss_file.c:169:fopen('/etc/ssl/certs/AddTrustExternalCARoot.crt','r'):

Mar 17 11:55:36 clarity postfix/smtp[14878]: warning: TLS library problem: 14878:error:2006D002:BIO routines:BIO_new_file:system lib:bss_file.c:174:

Mar 17 11:55:36 clarity postfix/smtp[14878]: warning: TLS library problem: 14878:error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib:by_file.c:279:

This led me to the SELinux audit log, where I see:

type=AVC msg=audit(1489751736.280:1341): avc: denied { read } for pid=14878 comm="smtp" name="AddTrustExternalCARoot.crt" dev=dm-0 ino=2228876 scontext=unconfined_u:system_r:postfix_smtp_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file

So I tried to follow instructions here to create a new policy allowing the reading of the cert in it's default location. Unfortunately it still didn't work, same error(s). I moved the cert to the postfix config directory /etc/postfix, updated main.cf, restarted postfix and now all is good. My question is how should I have created an SELinux policy to allow postfix to read certificates installed outside it's config directory?



I would suggest you to run restorecon -Rv /etc/ssl/ on the machine.

It seems that you have moved the file from your home directory without restoring the file context as you can see in the denial

  • This didn't actually fix my problem but +1 for putting me on the right track chcon -u system_u -t bin_t AddTrustExternalCARoot.crt sorted out the file to mirror other certs in the directory. You were right that the file was originally copied from /home/* Thanks – slowko Mar 17 '17 at 16:00
  • IMHO, the context for that file should be system_u:object_r:cert_t:s0 not bin_t. bin_t is for executable files – Bigon Mar 17 '17 at 16:32
  • Again, thanks. I rushed and checked (ls -Z) the wrong (type of) file. Changing to t_cert also works and is, as you say, more appropriate. – slowko Mar 17 '17 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.