Fedora Linux Support Community & Resources Center

Go Back   FedoraForum.org > Fedora 19/20 > Security and Privacy
FedoraForum Search

Forgot Password? Join Us!

Security and Privacy Sadly, malware, spyware, hackers and privacy threats abound in today's world. Let's be paranoid and secure our penguins, and slam the doors on privacy exploits.

Reply
 
Thread Tools Search this Thread Display Modes
  #1  
Old 23rd August 2008, 05:24 AM
bradchaus Offline
Registered User
 
Join Date: May 2006
Posts: 548
.forward file ignored, SELinux logs strange AVC.

Hi, I am running F9, Postfix, SELinux.

I have a .forward file in /root with contents "brian@localhost"

Mail to root, should be diverted to brian. But it only works if I put SELinux in permissive mode. SELinux logs a strange AVC as follows:

Code:
Raw Audit Messages :host=admin.brianac.com.au type=AVC 
msg=audit(1219464502.997:1874): avc: denied { search } for pid=16435 comm="local"
 name="root" dev=dm-7 ino=63489 scontext=system_u:system_r:postfix_local_t:s0 
tcontext=system_u:object_r:admin_home_t:s0 tclass=dir host=admin.brianac.com.au 
type=SYSCALL msg=audit(1219464502.997:1874): arch=40000003 syscall=196 
success=no exit=-13 a0=b83d6940 a1=bf826cb4 a2=7dfff4 a3=0 items=0 ppid=3274 
pid=16435 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 
tty=(none) ses=4294967295 comm="local" exe="/usr/libexec/postfix/local" 
subj=system_u:system_r:postfix_local_t:s0 key=(null)


The english language description from troubleshooter is :

Code:
SELinux has denied local access to potentially mislabeled file(s) (./root). This 
means that SELinux will not allow local to use these files. It is common for users to edit
files in their home directory or tmp directories and then move (mv) them to system 
directories. The problem is that the files end up with the wrong file context which confined 
applications are not allowed to access.
Note that it doesn't mention .forward. But it does mention ./root. What the hell is that?

Troubleshooter recommends running restorecon -R -v './root' . But that doesn't make sense. That's a relative path, not a full path.

Any ideas anyone?

Brian
__________________
* AMD Phenom 9750, 8GB DDR-1066, Gigabyte MA770UD3, ATI X550, F12 64bit
* Dual Athlon MP2800+, Gigabyte GA-7DPXDWP, 1GB, Centos 5.4

Linux Rules

Last edited by bradchaus; 23rd August 2008 at 05:28 AM.
Reply With Quote
  #2  
Old 23rd August 2008, 05:38 AM
marcrblevins Offline
Registered User
 
Join Date: Jun 2006
Location: Texas
Age: 43
Posts: 4,168
Code:
su -
ls -Z .forward
My result:
Code:
-rw-r--r--  root root unconfined_u:object_r:admin_home_t:s0 .forward
Is yours the same?
Reply With Quote
  #3  
Old 23rd August 2008, 05:40 AM
marcrblevins Offline
Registered User
 
Join Date: Jun 2006
Location: Texas
Age: 43
Posts: 4,168
Also check this:
Code:
[root@kiriyamablevins ~]# getsebool -a | grep post
allow_postfix_local_write_mail_spool --> on
[root@kiriyamablevins ~]#
Reply With Quote
  #4  
Old 23rd August 2008, 05:41 AM
bradchaus Offline
Registered User
 
Join Date: May 2006
Posts: 548
yep, identical
__________________
* AMD Phenom 9750, 8GB DDR-1066, Gigabyte MA770UD3, ATI X550, F12 64bit
* Dual Athlon MP2800+, Gigabyte GA-7DPXDWP, 1GB, Centos 5.4

Linux Rules
Reply With Quote
  #5  
Old 23rd August 2008, 05:42 AM
bradchaus Offline
Registered User
 
Join Date: May 2006
Posts: 548
Quote:
Originally Posted by marcrblevins
Also check this:
Code:
[root@kiriyamablevins ~]# getsebool -a | grep post
allow_postfix_local_write_mail_spool --> on
[root@kiriyamablevins ~]#

yeah mine is the same
__________________
* AMD Phenom 9750, 8GB DDR-1066, Gigabyte MA770UD3, ATI X550, F12 64bit
* Dual Athlon MP2800+, Gigabyte GA-7DPXDWP, 1GB, Centos 5.4

Linux Rules
Reply With Quote
  #6  
Old 23rd August 2008, 05:42 AM
bradchaus Offline
Registered User
 
Join Date: May 2006
Posts: 548
Quote:
Originally Posted by marcrblevins
Code:
su -
ls -Z .forward
My result:
Code:
-rw-r--r--  root root unconfined_u:object_r:admin_home_t:s0 .forward
Is yours the same?

yes, identical
__________________
* AMD Phenom 9750, 8GB DDR-1066, Gigabyte MA770UD3, ATI X550, F12 64bit
* Dual Athlon MP2800+, Gigabyte GA-7DPXDWP, 1GB, Centos 5.4

Linux Rules
Reply With Quote
  #7  
Old 23rd August 2008, 05:43 AM
marcrblevins Offline
Registered User
 
Join Date: Jun 2006
Location: Texas
Age: 43
Posts: 4,168
If you don't mind, please quote which is identical?
Reply With Quote
  #8  
Old 23rd August 2008, 05:51 AM
marcrblevins Offline
Registered User
 
Join Date: Jun 2006
Location: Texas
Age: 43
Posts: 4,168
Sorry Brad, I'm out of ideas. Mine is sendmail/dovecot and Selinux set to Enforcing(the default)
Reply With Quote
  #9  
Old 24th August 2008, 03:32 AM
bradchaus Offline
Registered User
 
Join Date: May 2006
Posts: 548
thankx for your ideas ... it has me stumped too ... but I think the key to the problem is understanding the AVC .. i wonder what it means by "./root"
__________________
* AMD Phenom 9750, 8GB DDR-1066, Gigabyte MA770UD3, ATI X550, F12 64bit
* Dual Athlon MP2800+, Gigabyte GA-7DPXDWP, 1GB, Centos 5.4

Linux Rules
Reply With Quote
Reply

Tags
avc, file, forward, logs, selinux, strange

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Strange logs Ricky Using Fedora 1 20th August 2007 09:14 PM
Understanding SELinux Audit logs.. Paprika Servers & Networking 2 19th April 2007 08:37 AM
Postfix, selinux and .forward smokinjoe Security and Privacy 2 23rd December 2006 07:11 AM


Current GMT-time: 20:40 (Friday, 31-10-2014)

TopSubscribe to XML RSS for all Threads in all ForumsFedoraForumDotOrg Archive
logo

All trademarks, and forum posts in this site are property of their respective owner(s).
FedoraForum.org is privately owned and is not directly sponsored by the Fedora Project or Red Hat, Inc.

Privacy Policy | Term of Use | Posting Guidelines | Archive | Contact Us | Founding Members

Powered by vBulletin® Copyright ©2000 - 2012, vBulletin Solutions, Inc.

FedoraForum is Powered by RedHat
Tekstilshchiki Photos - Magdalena Contreras Travel Photos on Instagram - Hanam Photos