Trying to restart postfix installed from yum. Restart fails, I get:
type=AVC msg=audit(1430429813.721:12167): avc: denied { unlink } for
pid=31624 comm="master" name="defer" dev="dm-0"
ino=981632
scontext=system_u:system_r:postfix_master_t:s0
tcontext=system_u:object_r:postfix_spool_maildrop_t:s0 tclass=sock_file
I guess it needs to remove the /var/spool/postfix/defer socket file.
audit2allow says this will fix it:
allow postfix_master_t postfix_spool_maildrop_t:sock_file unlink;
But how do I add this permission to the existing Postfix Selinux policy???
Why was it missing???
By the way, I also had AVCs when I tried to add another instance of
Postfix smtpd on local port 20025. Very frustrating there is no docs
how to add a rule for this common change. I don't know if I did the
right thing:
semanage port -a -t smtp_port_t -p tcp 20025
Is this the right way? Why isn't this documented somewhere?
> I guess it needs to remove the /var/spool/postfix/defer socket file.Sorry, thats: /var/spool/postfix/private/defer
Am 26.04.2015 um 06:22 schrieb E.B.:> Trying to restart postfix installed from yum. Restart fails, I get: > > type=AVC msg=audit(1430429813.721:12167): avc: denied { unlink } for > pid=31624 comm="master" name="defer" dev="dm-0" ino=981632 > scontext=system_u:system_r:postfix_master_t:s0 > tcontext=system_u:object_r:postfix_spool_maildrop_t:s0 tclass=sock_file > > I guess it needs to remove the /var/spool/postfix/defer socket file. > > audit2allow says this will fix it: > > allow postfix_master_t postfix_spool_maildrop_t:sock_file unlink; > > But how do I add this permission to the existing Postfix Selinux policy??? > Why was it missing???Multiple question marks are not necessary. You missed to tell us which precise CentOS release you are running and which version of Postfix. On my CentOS 6.6 the defer socket has SELinux type different than yours: # ls -alZ /var/spool/postfix/private/defer srw-rw-rw-. postfix postfix system_u:object_r:postfix_private_t:s0 /var/spool/postfix/private/defer> By the way, I also had AVCs when I tried to add another instance of > Postfix smtpd on local port 20025. Very frustrating there is no docs > how to add a rule for this common change. I don't know if I did the > right thing: > > semanage port -a -t smtp_port_t -p tcp 20025 > > Is this the right way? Why isn't this documented somewhere?That's well documented . https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html-single/Managing_Confined_Services/#chap-Managing_Confined_Services-Postfix