From: vaclav.ovsik@i.cz (=?iso-8859-2?Q?V=E1clav_Ovs=EDk?=)
Date: Fri, 29 Aug 2008 13:19:40 +0200
Subject: [refpolicy] Debian: postfix & sending mail by unconfined_u
Message-ID: <20080829111940.GA32593@bobek.pm.i.cz>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

Hi,
I have a question please. I'm running Debian Sid with SE Linux
& selinux-policy-default. I have installed postfix.
There are messages while user unconfined_u tries to send mail.

mail -s hello zito at bobek.localdomain <<<hello

results in

[  470.026225] type=1401 audit(1219924099.255:7): security_compute_sid:  invalid context unconfined_u:unconfined_r:postfix_postdrop_t:s0 for scontext=unconfined_u:unconfined_r:unconfined_mail_t:s0 tcontext=system_u:object_r:postfix_postdrop_exec_t:s0 tclass=process
[  470.037101] type=1300 audit(1219924099.255:7): arch=40000003 syscall=11 success=yes exit=0 a0=80c7f40 a1=80c8068 a2=80c78e0 a3=80c7f70 items=0 ppid=1868 pid=1869 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=107 sgid=107 fsgid=107 tty=pts1 ses=4294967295 comm="postdrop" exe="/usr/sbin/postdrop" subj=unconfined_u:unconfined_r:postfix_postdrop_t:s0 key=(null)


unconfined_r lacks some postfix types.

I was searching trough sources some time, but I could not find out, why
e.g. staff_u (staff_r) is able to use mail without problem, but
unconfined_r needs explicitly allowed types. Probably some attribute.
I found analogy with mta module (mta_per_role_template).

zito at bobek:~/SELinux/refpolicy-svn$ find . -regextype posix-egrep -name .svn -prune -o -name tmp -prune -o -name .pc -prune -o  -type f -regex '.*\.(te|if|fc)' -print|xargs egrep  'mta_per_role_template'
./policy/modules/services/mta.if:template(`mta_per_role_template',`
./policy/modules/system/unconfined.te:  mta_per_role_template(unconfined, unconfined_t, unconfined_r)

zito@bobek:~/SELinux/refpolicy-svn$ find . -regextype posix-egrep -name .svn -prune -o -name tmp -prune -o -name .pc -prune -o  -type f -regex '.*\.(te|if|fc)' -print|xargs egrep  'postfix_per_role_template'
./policy/modules/services/postfix.if:template(`postfix_per_role_template',`

The unconfined user is OK too after adding corresponding
postfix_per_role_template(...) for it (the patch attached).

Is such a solution right?

Thanks
-- 
Zito
-------------- next part --------------
Index: selinux-policy-src/policy/modules/system/unconfined.te
===================================================================
--- selinux-policy-src.orig/policy/modules/system/unconfined.te	2008-08-29 09:48:10.000000000 +0200
+++ selinux-policy-src/policy/modules/system/unconfined.te	2008-08-29 09:50:07.000000000 +0200
@@ -161,6 +161,7 @@
 ')
 
 optional_policy(`
+	postfix_per_role_template(unconfined, unconfined_t, unconfined_r)
 	postfix_run_map(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
 	# cjp: this should probably be removed:
 	postfix_domtrans_master(unconfined_t)