dovecot - Jun 2013 - Dovecot + SELinux permission problems

Hi, 

I have set-up dovecot on a F17 box and am encountering weirdnesses with
SELinux (who isn't??). Again, I am trying to refrain from disabling
SWLinux all together, however tempting, but am stuck in troubleshooting
and hope for some ideas...

With SELinux set to permissive, I can connect to dovecot and log in to
access my mail as expected.

With SELinux enforcing, I can connect to dovecot, but cannot login to
access mail. The log states

,---- log_path = /var/log/dovecot (set in 10-logging.conf)
| Jun 23 15:43:58 imap-login: Info: Login: user=<johndoe>, method=PLAIN,
rip=127.0.0.1, lip=127.0.0.1, mpid=15189, secured,
session=<xJl+U9PfvgB/AAAB>
| Jun 23 15:43:58 imap(johndoe): Error: chdir(/home/user/data1/Maildir//)
failed: Permission denied (euid=1000(user) egid=1000(user) missing +w perm:
/home/user/data1/Maildir// stat(/home/user/data1/Maildir//) failed: Permission
denied)
| Jun 23 15:43:58 imap(johndoe): Error: chdir(/home/user/data1/Maildir/) failed:
Permission denied
| Jun 23 15:43:58 imap(johndoe): Error: user johndoe: Initialization failed:
Namespace '': stat(/home/user/data1/Maildir//johndoe) failed: Permission
denied (euid=1000(user) egid=1000(user) missing +w perm:
/home/user/data1/Maildir//johndoe stat(/home/user/data1/Maildir//johndoe)
failed: Permission denied)
| Jun 23 15:43:58 imap(johndoe): Error: Invalid user settings. Refer to server
log for more information.
`----

Only thing I can grasp is *write permission* error. ls -l on the
Maildirs shows this should not be the case for uid 1000. 

,---- ls -l
| drwxrwxr-x. 11 user user  4096 Jul  8  2012 Maildir
| \> drwx------. 19 user user  4096 Feb  5 09:04 johndoe
`----

I have no idea what the server log is referring to, in the debug log I get

,---- debug_log_path = /var/log/dovecot_debug (set in 10-logging.conf)
| Jun 23 15:43:58 imap: Debug: Added userdb setting: mail=maildir:~/johndoe
| Jun 23 15:43:58 imap(johndoe): Debug: Effective uid=1000, gid=1000,
home=/home/user/data1/Maildir/
| Jun 23 15:43:58 imap(johndoe): Debug: Namespace inbox: type=private, prefix=,
sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes
location=maildir:~/johndoe
| Jun 23 15:43:58 imap(johndoe): Debug: maildir++:
root=/home/user/data1/Maildir//johndoe, index=, control=,
inbox=/home/user/data1/Maildir//johndoe, alt`----

I had thought SELinux would log something, but /var/log/audit/audit.log
is blank...

Where to go from here?? Any ideas appreciated...

-- 
Johnny

On Sun, Jun 23, 2013 at 04:21:17PM +0100, Johnny wrote:
> 
> I had thought SELinux would log something, but /var/log/audit/audit.log
> is blank...
Are you running auditd? I believe that if you're not running auditd, the
denials should be logged to the kernel ring buffer. Does "dmesg" show
any denials ?

Likely dovecot doesn't have access user_home_dir_t/user_home_t. Is all
users maildirs below /home/user/data1/Maildir/ ? If so, you can probably
fix this by creating a labeling rule for this, and re-label everything
below this directory:

	semanage fcontext -a -t mail_spool_t "/home/user/data1/Maildir(/.*)?"
	restorecon -R /home/user/data1/Maildir


  -jf

On 6/24/2013 9:58 AM, Johnny wrote:
> Yes, /var/log/audit/ with audit.log. There are some archived logs as
> well, but no recent messages regarding dovecot perms.
Typically you could use "sealert -a /var/log/audit/audit.log 
/var/log/audit/audit.log.1" to get a feel for how many SELinux 
exceptions are happening.

Also, when you say that the restorecon -R did not fix the issue, did you 
check the output of "ls -Z" after running it?

However, looking at your original message, I'm wondering why the forward 
slashes are doubled up.  For instance: "/home/user/data1/Maildir//"