SELinux prevents Squirrelmail from sending

[termdex]

Just setup a FC5 server with SquirrelMail...
Already did the connect boolean thing so I can login...
But now when I try to send a message through SquirrelMail nothing happens.
Checking /var/log/messages shows:

Jun 7 07:33:41 host1 kernel: audit(1149687221.585:503): avc: denied { execute } for pid=5499 comm="httpd" name="bash" dev=hda2 ino=32289 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file

And I get one of these for every message I try to send with SquirrelMail.
Apparently, SquirrelMail has httpd shellout to do something which selinux prevents. I never had this problem on FC3, the previous server.

I found a selinux apache man page
http://fedoraproject.org/wiki/SELinux/apache
where "You can disable SELinux protection for the httpd daemon by executing:

setsebool -P httpd_disable_trans 1
service httpd restart
"

But I'd rather fix just this specific issue than unilaterly disabling SElinux for apache.

[bhaskar]

Sending emails from squirrelmail-1.4.7-4.fc5.noarch.rpm on Fedora Core 5
I also had very tough time in patching up the selinux. I do not want to
remove security to httpd via selinux.
Here is the solution atlast I found
Create local.te with vi
=========
local.te
==========

module httpd 1.0;

require {
class file { execute getattr read write };
class file execute_no_trans;
class tcp_socket name_connect;
type httpd_t;
type shell_exec_t;
type pop_port_t;
type dovecot_auth_t;
type initrc_var_run_t;
type prelink_t;
type shell_exec_t;
type src_t;
type tmp_t;
role system_r;
};

allow httpd_t pop_port_t:tcp_socket name_connect;
allow httpd_t shell_exec_t:file execute_no_trans;
allow dovecot_auth_t initrc_var_run_t:file { read write };
allow httpd_t shell_exec_t:file execute;
allow httpd_t shell_exec_t:file read;
allow httpd_t tmp_t:file { getattr read };
allow prelink_t src_t:file read;

#ALLOW=local
#checkmodule -M -m -o $ALLOW.mod $ALLOW.te
#semodule_package -o $ALLOW.pp -m $ALLOW.mod
#semodule -i $ALLOW.pp

This will install local.te rules and now it should send the email
I am using default dovecot

Hope this is useful

Bhaskar