https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6052
Summary: SELINUX blocks spamc access to port 7500
Product: Spamassassin
Version: 3.2.5
Platform: Other
OS/Version: Linux
Status: NEW
Severity: major
Priority: P5
Component: spamc/spamd
AssignedTo: [email protected]
ReportedBy: [email protected]
My message log is filled with selinux messages. When I log into X I found this
SELinux error. I do not even have spamd running or use spamc, but I call
spamassassin via procmail to scan email. I use Fedora Core 10, postfix, and
procmail. I have spamassassin 3.2.5. I am including the error I found from
selinux here.
SELinux is preventing the spamassassin (spamc_t) from binding to port 7500.
Detailed Description:
SELinux has denied the spamassassin from binding to a network port 7500 which
does not have an SELinux type associated with it. If spamassassin is supposed
to
be allowed to listen on this port, you can use the semanage command to add this
port to a port type that spamc_t can bind to. semanage port -l will list all
port types. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy
package. If spamassassin is not supposed to bind to this port, this could
signal
a intrusion attempt. If this system is running as an NIS Client, turning on the
allow_ypbind boolean, may fix the problem. setsebool -P allow_ypbind=1.
Allowing Access:
If you want to allow spamassassin to bind to this port semanage port -a -t
PORT_TYPE -p PROTOCOL 7500 Where PORT_TYPE is a type that spamc_t can bind and
PROTOCOL is udp or tcp.
Additional Information:
Source Context system_u:system_r:spamc_t:s0
Target Context system_u:object_rort_t:s0
Target Objects None [ udp_socket ]
Source spamassassin
Source Path /usr/bin/perl
Port 7500
Host wild-missouri.dyndns.org
Source RPM Packages perl-5.10.0-52.fc10
Target RPM Packages
Policy RPM selinux-policy-3.5.13-38.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name bind_ports
Host Name wild-missouri.dyndns.org
Platform Linux wild-missouri.dyndns.org
2.6.27.9-159.fc10.i686 #1 SMP Tue Dec 16 15:12:04
EST 2008 i686 i686
Alert Count 53268
First Seen Sat 24 Jan 2009 10:07:33 PM EST
Last Seen Mon 26 Jan 2009 01:25:14 PM EST
Local ID 4976cbb7-0595-4362-ad5f-7f401b4b5255
Line Numbers
Raw Audit Messages
node=wild-missouri.dyndns.org type=AVC msg=audit(1232994314.37:64514): avc:
denied { name_bind } for pid=3158 comm="spamassassin" src=7500
scontext=system_u:system_r:spamc_t:s0 tcontext=system_u:object_rort_t:s0
tclass=udp_socket
node=wild-missouri.dyndns.org type=SYSCALL msg=audit(1232994314.37:64514):
arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bfc6c770 a2=dea5ec a3=10
items=0 ppid=3157 pid=3158 auid=4294967295 uid=500 gid=500 euid=500 suid=500
fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4294967295
comm="spamassassin" exe="/usr/bin/perl" subj=system_u:system_r:spamc_t:s0
key=(null)
--
Configure bugmail:
https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
