On Fedora 14, I am setting up postfix and mailman.
I had this working once, but I decided to yum erase postfix and mailman and redo the configuration to prove I knew how to recreate it.
Turns out I don't know how to recreate a working combination because when creating a new list I now have mailman error log that talks about:
command failed: /usr/sbin/postalias /etc/mailman/aliases (status: 1, Operation not permitted)
and a corresponding AVC error:
Aug 25 10:28:54 (null) (null): audit(1314282534.501:4326): avc: denied { search } for pid=12121 comm=postalias name=postfix ino=295074 dev=dm-0 scontext=system_u:system_r:mailman_cgi_t:s0 tcontext=system_u:object_r:postfix_etc_t:s0 tclass=dir
Suggestions?
Fulko
Can you provide the ls -Z of your content in /etc/mailman/aliases A advice:, use sealert to see a more human-readable approach to analyze the SELinux logs.
2011/8/25 Fulko Hew fulko.hew@gmail.com
On Fedora 14, I am setting up postfix and mailman.
I had this working once, but I decided to yum erase postfix and mailman and redo the configuration to prove I knew how to recreate it.
Turns out I don't know how to recreate a working combination because when creating a new list I now have mailman error log that talks about:
command failed: /usr/sbin/postalias /etc/mailman/aliases (status: 1, Operation not permitted)
and a corresponding AVC error:
Aug 25 10:28:54 (null) (null): audit(1314282534.501:4326): avc: denied { search } for pid=12121 comm=postalias name=postfix ino=295074 dev=dm-0 scontext=system_u:system_r:mailman_cgi_t:s0 tcontext=system_u:object_r:postfix_etc_t:s0 tclass=dir
Suggestions?
Fulko
-- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
On Thu, Aug 25, 2011 at 12:13 PM, Marcos Luis Ortiz Valmaseda < marcosluis2186@googlemail.com> wrote:
Can you provide the ls -Z of your content in /etc/mailman/aliases
[root@netwatch log]# ls -Z /etc/mailman/aliases -rw-rw----. root mailman unconfined_u:object_r:mailman_data_t:s0 /etc/mailman/aliases
A advice:, use sealert to see a more human-readable approach to analyze the
SELinux logs.
While waiting for a response from the list... I had just (discovered and) done a:
# grep postalias /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp
But I haven't tested it yet.
2011/8/25 Fulko Hew fulko.hew@gmail.com
On Fedora 14, I am setting up postfix and mailman.
I had this working once, but I decided to yum erase postfix and mailman and redo the configuration to prove I knew how to recreate it.
Turns out I don't know how to recreate a working combination because when creating a new list I now have mailman error log that talks about:
command failed: /usr/sbin/postalias /etc/mailman/aliases (status: 1, Operation not permitted)
and a corresponding AVC error:
Aug 25 10:28:54 (null) (null): audit(1314282534.501:4326): avc: denied { search } for pid=12121 comm=postalias name=postfix ino=295074 dev=dm-0 scontext=system_u:system_r:mailman_cgi_t:s0 tcontext=system_u:object_r:postfix_etc_t:s0 tclass=dir
Suggestions?
Fulko
Well, test it and say the response to us.
2011/8/25 Fulko Hew fulko.hew@gmail.com
On Thu, Aug 25, 2011 at 12:13 PM, Marcos Luis Ortiz Valmaseda < marcosluis2186@googlemail.com> wrote:
Can you provide the ls -Z of your content in /etc/mailman/aliases
[root@netwatch log]# ls -Z /etc/mailman/aliases -rw-rw----. root mailman unconfined_u:object_r:mailman_data_t:s0 /etc/mailman/aliases
A advice:, use sealert to see a more human-readable approach to analyze the
SELinux logs.
While waiting for a response from the list... I had just (discovered and) done a:
# grep postalias /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp
But I haven't tested it yet.
2011/8/25 Fulko Hew fulko.hew@gmail.com
On Fedora 14, I am setting up postfix and mailman.
I had this working once, but I decided to yum erase postfix and mailman and redo the configuration to prove I knew how to recreate it.
Turns out I don't know how to recreate a working combination because when creating a new list I now have mailman error log that talks about:
command failed: /usr/sbin/postalias /etc/mailman/aliases (status: 1, Operation not permitted)
and a corresponding AVC error:
Aug 25 10:28:54 (null) (null): audit(1314282534.501:4326): avc: denied { search } for pid=12121 comm=postalias name=postfix ino=295074 dev=dm-0 scontext=system_u:system_r:mailman_cgi_t:s0 tcontext=system_u:object_r:postfix_etc_t:s0 tclass=dir
Suggestions?
Fulko
-- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 08/25/2011 11:52 AM, Fulko Hew wrote:
On Fedora 14, I am setting up postfix and mailman.
I had this working once, but I decided to yum erase postfix and mailman and redo the configuration to prove I knew how to recreate it.
Turns out I don't know how to recreate a working combination because when creating a new list I now have mailman error log that talks about:
command failed: /usr/sbin/postalias /etc/mailman/aliases (status: 1, Operation not permitted)
and a corresponding AVC error:
Aug 25 10:28:54 (null) (null): audit(1314282534.501:4326): avc: denied { search } for pid=12121 comm=postalias name=postfix ino=295074 dev=dm-0 scontext=system_u:system_r:mailman_cgi_t:s0 tcontext=system_u:object_r:postfix_etc_t:s0 tclass=dir
Suggestions?
Fulko
restorecon -R -v /etc/mailman
Should change the label.
Should be
system_u:object_r:mailman_data_t:s0
On Thu, Aug 25, 2011 at 12:20 PM, Marcos Luis Ortiz Valmaseda < marcosluis2186@googlemail.com> wrote:
Well, test it and say the response to us.
So the first issue was: SELinux is preventing /usr/sbin/postalias from search access on the directory /etc/postfix.
It then complained (one at a time) about: SELinux is preventing /usr/sbin/postalias from read access on the file /etc/postfix/main.cf. SELinux is preventing /usr/sbin/postalias from open access on the file /etc/postfix/main.cf. SELinux is preventing /usr/sbin/postalias from getattr access on the file /etc/postfix/main.cf.
So I redid 'audit2allow' over and over to get past each problem.
...I can continue to do this, or disable SELinux, but I shouldn't have to, something else is wrong here. ;-(
Finally, I can now create a new mailing list.
2011/8/25 Fulko Hew fulko.hew@gmail.com
On Thu, Aug 25, 2011 at 12:13 PM, Marcos Luis Ortiz Valmaseda < marcosluis2186@googlemail.com> wrote:
Can you provide the ls -Z of your content in /etc/mailman/aliases
[root@netwatch log]# ls -Z /etc/mailman/aliases -rw-rw----. root mailman unconfined_u:object_r:mailman_data_t:s0 /etc/mailman/aliases
A advice:, use sealert to see a more human-readable approach to analyze
the SELinux logs.
While waiting for a response from the list... I had just (discovered and) done a:
# grep postalias /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp
But I haven't tested it yet.
2011/8/25 Fulko Hew fulko.hew@gmail.com
On Fedora 14, I am setting up postfix and mailman.
I had this working once, but I decided to yum erase postfix and mailman and redo the configuration to prove I knew how to recreate it.
Turns out I don't know how to recreate a working combination because when creating a new list I now have mailman error log that talks about:
command failed: /usr/sbin/postalias /etc/mailman/aliases (status: 1, Operation not permitted)
and a corresponding AVC error:
Aug 25 10:28:54 (null) (null): audit(1314282534.501:4326): avc: denied { search } for pid=12121 comm=postalias name=postfix ino=295074 dev=dm-0 scontext=system_u:system_r:mailman_cgi_t:s0 tcontext=system_u:object_r:postfix_etc_t:s0 tclass=dir
Suggestions?
Fulko
-
Daniel J Walsh -
Fulko Hew -
Marcos Luis Ortiz Valmaseda