dovecot - Apr 2009 - SELinux and "i_stream_read() failed: Permission denied"

Not a problem ... sharing a solution (this time)! Please correct my
understanding of the process, if required.

"i_stream_read() failed: Permission denied" is an error message
generated
when a large-ish file (>128kb in my case) is attached to a message that
has been passed to Dovecot's deliver program when SELinux is being
enforced.

In my case, these messages are first run through Spamassassin, then passed
to deliver, however the SELinux policy that is being violated relates to
deliver, and not to Spamassassin, even though I do NOT generate the errors
WITHOUT running Spamassassin. I'm not going to guess as to why that is.
The policies below resolve the issue, and now large-ish (even LARGE)
attachments come through without a whimper with
Postfix+Spamassassin+Dovecot.

The problem is that deliver is not running with the correct SELinux policy
to be able to write to the global /tmp directory (in my case, after
receiving the big attachment from SA), even if that directory's
permissions allow it. (Bless you, SELinux!) Small-ish file attachments do
not trigger this deliver functionality.

Here's a complete error message, and its subsequent errors in the course
of delivering a large-ish message+attachment:

==================================================deliver(user):
unlink(/tmp/dovecot.deliver.. \
  1239836047.9469.46242b1037005551) failed: Permission denied
deliver(user): copy: i_stream_read() failed: Permission denied
deliver(user): read(mail, uid=1) failed: Permission denied
deliver(user): read(mail, uid=1) failed: Permission denied
deliver(user): msgid=: save failed to INBOX: Internal error occurred. \
  Refer to server log for more information. [2009-04-15 17:54:07]
==================================================
This is the final error series received before the policies were finally
updated, and shows an error during deliver's attempt to "unlink()"
(remove) the temporary file. Previous errors occurred during attempts to
"stat()"  and "creat()" (sic) the temporary files.

Basically, the "dovecot_deliver_t" context needs to be able to create,
read, write and remove files in the /tmp directory ("tmp_t" context).

Below, I am pasting my "local_postfix.te" SELinux policy file. It
includes
instructions for using it, and for figuring out how to do other SELinux
policy adjustments on your own. This is my COMPLETE Postfix+Dovecot
SELinux policy group. I also have policies for Spamassassin, if anyone
wants them. If you are running Sendmail or another MTA instead of Postfix,
you can build on what you find below and establish your own policies.

I hope this proves useful. Again, please feel free to correct any
misunderstandings I may be promoting with this message.

Use at your own risk, please! No guarantees ... it just worked, for me.

James

## NOTE: I have broken lines in the following using the standard "\"
notation to fix the email format better. However the local_postfix.te file
should NOT have ANY lines broken. Remove my "\" notation and keep the
lines together and you should be okay. ##

####### HOW TO USE THIS ####################################################
# SELinux, Postfix, Dovecot                                                #
# SELinux needs help resolving Postfix+Dovecot context issues.             #
# This file + the following instructions should get you                    #
# on your way to resolving the policies between those contexts.            #
#                                                                          #
# 1) Create this file with the data shown below:                           #
#     local_postfix.te                                                     #
# 2) Compile this file:                                                    #
#     checkmodule -M -m -o local_postfix.mod local_postfix.te              #
# 3) Create SELinux policy package:                                        #
#     semodule_package -o local_postfix.pp -m local_postfix.mod            #
# 4) Move policy package to normal SELinux modules directory:              #
#     mv local_postfix.pp /etc/selinux/targeted/modules/active/modules/    #
# 5) Update kernel with new policy package:                                #
#     semodule -i \                                                        #
#       /etc/selinux/targeted/modules/active/modules/local_postfix.pp      #
#                                                                          #
# Test: Send mail from remote to this system.                              #
# Check /var/log/maillog for mail errors and                               #
# /var/log/messages & /var/log/audit/audit.log for more specific           #
# SELinux errors                                                           #
# Also, SELinux will provide the command (sealert...) for more details     #
# Use the error info you see in messages (or sealert...) to create         #
# new entries in local_postfix.te, then re-compile, package                #
# and update the kernel.                                                   #
#                                                                          #
# Alternately, you can use this to generate a .te file automatically       #
# from the SELinux errors displayed in /var/log/audit/audit.log (or        #
# from /var/log/messages IF you do NOT have audit installed):              #
#                                                                          #
#  audit2allow -m local -l -i /var/log/audit/audit.log > local_postfix.te  #
#                                                                          #
# (This is also helpful if you can't guess the correct domain/policy to    #
# use from reading the error messages.) Take the new stuff from what       #
# audit2allow creates and add it to this file, then re-compile, package    #
# and update the kernel.                                                   #
############################################################################

module local_postfix 1.0;

require {
        type admin_home_t;
        type bin_t;
        type default_t;
        type dovecot_t;
        type dovecot_deliver_t;
        type dovecot_deliver_exec_t;
        type dovecot_var_log_t;
        type etc_runtime_t;
        type fs_t;
        type home_root_t;
        type httpd_config_t;
        type httpd_t;
        type initrc_t;
        type postfix_etc_t;
        type postfix_local_t;
        type postfix_master_t;
        type postfix_postdrop_t;
        type postfix_postqueue_exec_t;
        type postfix_public_t;
        type postfix_pipe_t;
        type sendmail_t;
        type sendmail_exec_t;
        type src_t;
        type tmp_t;
        type usr_t;
        type user_home_dir_t;
        type user_home_t;
        type var_log_t;
        class capability { sys_nice chown };
        class file { append create execute execute_no_trans \
          getattr ioctl link lock read rename setattr write unlink };
        class dir { add_name getattr create read remove_name \
          rename write search setattr rmdir };
        class fifo_file { getattr write };
        class filesystem getattr;
        class sock_file write;
        class unix_stream_socket { connectto getattr read write };
}

#============= dovecot_t ==============allow dovecot_t home_root_t:file { create
getattr link lock \
 read rename setattr unlink write };
allow dovecot_t home_root_t:dir { add_name create remove_name write };

#============= dovecot_deliver_t =============allow dovecot_deliver_t tmp_t:dir
getattr;
allow dovecot_deliver_t fs_t:filesystem getattr;
allow dovecot_deliver_t dovecot_var_log_t:file append;
allow dovecot_deliver_t initrc_t:unix_stream_socket connectto;
allow dovecot_deliver_t tmp_t:dir { add_name remove_name search write };
allow dovecot_deliver_t tmp_t:file { create read unlink write };
allow dovecot_deliver_t var_log_t:dir search;
allow dovecot_deliver_t var_log_t:file append;

#============ httpd_t ================allow httpd_t postfix_etc_t:dir search;

#============= postfix_local_t =============allow postfix_local_t
home_root_t:file { create getattr link unlink write };
allow postfix_local_t admin_home_t:dir { create read write };
allow postfix_local_t home_root_t:dir { add_name create remove_name write };
allow postfix_local_t clamd_var_lib_t:dir { add_name create remove_name \
 rename setattr write read };
allow postfix_local_t clamd_var_lib_t:file { create link lock read rename \
 getattr setattr unlink write };
allow postfix_local_t home_root_t:dir { rename setattr };
allow postfix_local_t self:capability { sys_nice chown };
allow postfix_local_t sendmail_exec_t:file { read execute ioctl \
 execute_no_trans };
allow postfix_local_t spamc_exec_t:file { execute execute_no_trans \
 getattr read };
allow postfix_local_t usr_t:file { append execute execute_no_trans \
 read getattr write };
allow postfix_local_t default_t:file { create getattr read write }; allow
postfix_local_t default_t:dir { add_name remove_name search write }; allow
postfix_local_t user_home_dir_t:file { read write getattr rename };

#============= postfix_master_t ==============allow postfix_master_t src_t:dir
search;

#============= postfix_pipe_t =============allow postfix_pipe_t bin_t:file {
execute execute_no_trans read }; allow
postfix_pipe_t postfix_public_t:sock_file write;

#============= postfix_postdrop_t ==============allow postfix_postdrop_t
initrc_t:fifo_file { write getattr };
allow postfix_postdrop_t postfix_local_t:unix_stream_socket { getattr \
 read write };
allow postfix_postdrop_t user_home_t:file append;

#============= sendmail_t =============allow sendmail_t
postfix_local_t:fifo_file { getattr write };
allow sendmail_t postfix_postqueue_exec_t:file { execute \
 execute_no_trans read };

On Wed, 2009-04-15 at 16:47 -0700, James Butler wrote:
> "i_stream_read() failed: Permission denied" is an error message
generated
> when a large-ish file (>128kb in my case) is attached to a message that
> has been passed to Dovecot's deliver program when SELinux is being
> enforced.
..
> The problem is that deliver is not running with the correct SELinux policy
> to be able to write to the global /tmp directory
BTW. Dovecot v1.2+ no longer writes to /tmp directory. Writing to /tmp
was pretty evil.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20090415/77c677a9/attachment-0002.bin>

> On Wed, 2009-04-15 at 16:47 -0700, James Butler wrote:
>> "i_stream_read() failed: Permission denied" is an error
message
>> generated
>> when a large-ish file (>128kb in my case) is attached to a message
that
>> has been passed to Dovecot's deliver program when SELinux is being
>> enforced.
> ..
>> The problem is that deliver is not running with the correct SELinux
>> policy
>> to be able to write to the global /tmp directory
>
> BTW. Dovecot v1.2+ no longer writes to /tmp directory. Writing to /tmp
> was pretty evil.
>
>
I hear ya. I'm running v.1.2.rc2 ... is there a newer version?