Hi all,
I'm trying to add some milters (particularly spamass-milter and
clamav-milter, which I acquired through rpmforge) to my postfix
configuration on Centos5 with the targeted SELinux policy..
I'm running into difficulty getting postfix to communicate through the
unix domain sockets created by the milters, because selinux keeps
blocking them. I've attempted to use audit2allow to fix this, and made
some progress in allowing postfix to write to the socket. I'm getting
stuck on the following audit.log error, though.
type=AVC msg=audit(1210016235.033:6265): avc: denied { use } for
pid=17995 comm="cleanup" path="socket:[372498]" dev=sockfs
ino=372498
scontext=root:system_r:postfix_cleanup_t:s0
tcontext=root:system_r:postfix_smtpd_t:s0 tclass=fd
type=SYSCALL msg=audit(1210016235.033:6265): arch=c000003e syscall=47
success=yes exit=1 a0=9 a1=7fff0ec2f220 a2=0 a3=0 items=0 ppid=17983
pid=17995 auid=0 uid=89 gid=89 euid=89 suid=89 fsuid=89 egid=89 sgid=89
fsgid=89 tty=(none) comm="cleanup"
exe="/usr/libexec/postfix/cleanup"
subj=root:system_r:postfix_cleanup_t:s0 key=(null)
I use audit2allow to try to fix this, but the resulting rule:
allow postfix_cleanup_t postfix_smtpd_t:fd use;
does nothing to help. Has anyone succesfully added unix domain socket
based milters to postfix without disabling selinux? If anyone has any
suggestions, I'd be grateful.
Thanks,
Michael Saavedra
