Re: [debian] postfix chroot setup from /etc/init.d/postfix isn't working.

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Wed, Jun 09, 2004 at 09:41:26PM +0000, Luke Kenneth Casson Leighton wrote:
> hi,
> 
> debian's postfix init.d script does a whole stackload of
> things like copy over /etc/localtime, /etc/services.
 
 i should be more specific: in the creation of the chroot jail,
 in /var/spool/postfix, the permissions (contexts) are preserved
 and recreated (see file_contexts/programs/postfix.fc)

 i.e., in order for the /etc/init.d/postfix script to create the
 chroot jail, it is necessary to give initrd_t permissions
 sufficient to write to etc_t, amongst other things.

 the chroot jail needs a copy of /etc/localtime and /lib/libnss* and
 such-like.

 clearly from an selinux perspective, the /etc/init.d/postfix
 script cannot be an appropriate place to set up a chroot jail.

 can anyone think of a way in which this could be better achieved?

 bearing in mind that the solution must take into account that
 postfix can be run in a chroot jail or not, depending on
 an administrative decision.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.