Re: cgiemail and senmail policy

[Daniel J Walsh <dwalsh@redhat.com>]

R. Steven Rainwater wrote:

>I'm running a CentOS 4.1 (Red Hat EL) box with an Apache web server. I
>thought I'd worked out all the problems with my cgi scripts but a new
>one cropped up today. We use the good ol' MIT cgiemail program to handle
>form submissions that get sent via sendmail. When someone submits a
>form, I get a series of avc errors and no email gets sent. What's the
>best way to fix this (i.e. to make Apache able to use cgiemail to send
>email via sendmail)?  Here are the errors I'm getting:
> 
>Jun 30 16:47:33 orac kernel: audit(1120168053.409:0): avc:  denied  {
>write } for  pid=27969 comm=sendmail path=/tmp/filegvNeNa dev=dm-0
>ino=948452 scontext=root:system_r:system_mail_t
>tcontext=root:object_r:httpd_sys_script_rw_t tclass=file
>
>Jun 30 16:47:33 orac kernel: audit(1120168053.410:0): avc:  denied  {
>write } for  pid=27969 comm=sendmail path=/tmp/filegvNeNa dev=dm-0
>ino=948452 scontext=root:system_r:system_mail_t
>tcontext=root:object_r:httpd_sys_script_rw_t tclass=file
>
>Jun 30 16:47:33 orac kernel: audit(1120168053.410:0): avc:  denied  {
>write } for  pid=27969 comm=sendmail path=/tmp/filegvNeNa dev=dm-0
>ino=948452 scontext=root:system_r:system_mail_t
>tcontext=root:object_r:httpd_sys_script_rw_t tclass=file
>
>Jun 30 16:47:33 orac kernel: audit(1120168053.410:0): avc:  denied  {
>read write } for  pid=27969 comm=sendmail path=/tmp/tmpfKM8Top (deleted)
>dev=dm-0 ino=948418 scontext=root:system_r:system_mail_t
>tcontext=root:object_r:httpd_sys_script_rw_t tclass=file
>
>Jun 30 16:47:33 orac kernel: audit(1120168053.510:0): avc:  denied  {
>search } for  pid=27969 comm=sendmail name=www dev=dm-0 ino=556110
>scontext=root:system_r:system_mail_t
>tcontext=system_u:object_r:httpd_sys_content_t tclass=dir
>
>Jun 30 16:47:33 orac kernel: audit(1120168053.511:0): avc:  denied  {
>getattr }
>for  pid=27969 comm=sendmail path=/var/www dev=dm-0 ino=556110
>scontext=root:system_r:system_mail_t
>tcontext=system_u:object_r:httpd_sys_content_t tclass=dir
>
>
>
>The system is using selinux-policy-targeted-1.17.30-2.88.
>
>-Steve
>
>  
>
Upgrade to    the latest RHEL policy on.

ftp://people.redhat.com/dwalsh/SELinux/RHEL4/u1

Dan

-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.