fedora-selinux / selinux-policy

selinux-policy for Fedora is a large patch off the mainline
GNU General Public License v2.0
156 stars 157 forks source link

postfix: allow qmgr to delete mails in bounce/ directory #2072

Closed rmetrich closed 3 months ago

rmetrich commented 3 months ago

See RHEL-30271 - postfix qmgr cannot delete mails in bounce/ directory.

AVC:

... type=PROCTITLE msg=...: proctitle=qmgr-l-tunix-u
... type=PATH msg=...: item=1 name=bounce/E40A741281B ... obj=system_u:object_r:postfix_spool_bounce_t:s0 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
... type=PATH msg=...: item=0 name=bounce/ ... obj=system_u:object_r:postfix_spool_bounce_t:s0 nametype=PARENT cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
... type=CWD msg=...: cwd=/var/spool/postfix
... type=SYSCALL msg=...: arch=c000003e syscall=87 success=no exit=-13 ... comm=qmgr exe=/usr/libexec/postfix/qmgr subj=system_u:system_r:postfix_qmgr_t:s0 key=(null)
... type=AVC msg=...: avc:  denied  { write } for  pid=2012444 comm=qmgr name=bounce ... scontext=system_u:system_r:postfix_qmgr_t:s0 tcontext=system_u:object_r:postfix_spool_bounce_t:s0 tclass=dir permissive=0
zpytela commented 3 months ago

Merging, thank you.