I have migrated my old Mailman server to a CentOS 8.3 server containing this Mailman RPM package: mailman-2.1.29-10.module_el8.3.0+548+3169411d.x86_64 I would like to enable Google reCAPTCHA in mm_cfg.py as explained in /usr/lib/mailman/Mailman/Defaults.py with: RECAPTCHA_SITE_KEY = xxx RECAPTCHA_SECRET_KEY = yyy I have created the prerequisite V2 keys on https://www.google.com/recaptcha/admin and restarted the mailman service. The Mailman list page now contains a nice "I'm not a robot" frame as expected.
However, when I click "Subscribe", the confirmation page says "[Errno 13] Permission denied” (copied from my memory) and the subscription fails :-( It finally dawned upon me that this could be a SELinux issue, since I naturally want Enforcing mode. If I use "setenforce Permissive" the Mailman error goes away! The command "journalctl -t setroubleshoot" tells me: SELinux is preventing /usr/bin/python2.7 from name_connect access on the tcp_socket port 443. (lines deleted) If you believe that python2.7 should be allowed name_connect access on the port 443 tcp_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'python2' --raw | audit2allow -M my-python2 # semodule -X 300 -i my-python2.pp I can confirm that the Mailman error is fixed by this workaround. Question: Is there a proper way to configure this SELinux access for python2.7, rather than making this workaround? Such a solution should be submitted as a bug report to RedHat/CentOS/Fedora. Thanks a lot, Ole ------------------------------------------------------ Mailman-Users mailing list -- mailman-users@python.org To unsubscribe send an email to mailman-users-le...@python.org https://mail.python.org/mailman3/lists/mailman-users.python.org/ Mailman FAQ: http://wiki.list.org/x/AgA3 Security Policy: http://wiki.list.org/x/QIA9 Searchable Archives: https://www.mail-archive.com/mailman-users@python.org/ https://mail.python.org/archives/list/mailman-users@python.org/
