Re: [debian] postfix chroot setup from /etc/init.d/postfix isn't working.

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Thu, Jun 10, 2004 at 03:52:14PM -0400, Stephen Smalley wrote:
> On Thu, 2004-06-10 at 15:32, Ed Street wrote:
> > Well like they say chroot is the poor mans security setup :) Disabling the
> > chroot jail would be the best solution overall.
> 
> Defense in depth is a good idea, so using chroot (or other measures) in
> combination with SELinux is quite sensible...
 
 then, ideally, the stuff that creates the chroot jail needs to be moved into
 a separate "helper" script that can be run in its own context

 and the postfix.te script needs to have these added:

	 allow postfix_cleanup_t postfix_cleanup_t:capability { sys_chroot };
	 allow postfix_master_t postfix_master_t:capability { sys_chroot };
	 allow postfix_pickup_t postfix_pickup_t:capability { sys_chroot };
	 allow postfix_qmgr_t postfix_qmgr_t:capability { sys_chroot };

 and possibly more?  i am only running a local-delivery-only postfix.


 or, i am sure that there are people on this list who can think of a
 safe way to do this.

 l.

-- 
-- 
Information I post is with honesty, integrity, and the expectation that
you will take full responsibility for acting on the information contained,
and that, should you find it to be flawed or even mildly useful, you
will act with both honesty and integrity in return - and tell me.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.