From: Mike Edenfield <kutulu@kutulu.org>
To: gentoo-hardened@lists.gentoo.org
Subject: Re: [gentoo-hardened] Troubleshooting FIFO pipes with bad security contexts...
Date: Sat, 06 Aug 2011 18:40:09 -0400 [thread overview]
Message-ID: <5256381.URYclHXeOG@platypus> (raw)
In-Reply-To: <20110806201239.GA10064@siphos.be>
On Saturday, August 06, 2011 10:12:39 PM Sven Vermeulen wrote:
> On Sat, Aug 06, 2011 at 12:50:46PM -0400, Mike Edenfield wrote:
> > I'm trying to chase down an AVC message coming from procmail. I'm having
> > a problem figuring out how to research, troubleshoot, or fix bad FIFO
> > pipe contexts.
> >
> > The AVC I get is:
> >
> > Aug 6 12:15:52 basement kernel: type=1400 audit(1312647352.712:9623):
> > avc: denied { write } for pid=9816 comm="procmail" path="pipe:[4235]"
> > dev=pipefs ino=4235 scontext=system_u:system_r:procmail_t
> > tcontext=system_u:system_r:postfix_master_t tclass=fifo_file
>
> Any idea what procmail is trying to do at this point?
Hm. Not offhand, and for some reason it seems to have stopped trying to do it.
The only connection I have between procmail and postfix is the usual:
main.cf:mailbox_command = /usr/bin/procmail -a "$EXTENSION"
I use procmail mostly for mailing list filtering but that appears to be working
fine without any AVCs, so I'm not sure where these came from. I'll poke around
some more and see if I can figure it out, but at least now I have a better idea
what the policy is supposed to be doing :)
--Mike
prev parent reply other threads:[~2011-08-06 22:51 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-08-06 16:50 [gentoo-hardened] Troubleshooting FIFO pipes with bad security contexts Mike Edenfield
2011-08-06 20:12 ` Sven Vermeulen
2011-08-06 22:40 ` Mike Edenfield [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5256381.URYclHXeOG@platypus \
--to=kutulu@kutulu.org \
--cc=gentoo-hardened@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox