On 2/4/19 8:55 PM, Robert Moskowitz wrote: > I am working with Centos7: > > I have configured Dovecot to connect to mysqld via socket: > > connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix > password=Postfix_Database_Password > > I test sending a message with > > sendmail -i rgm(a)test.htt-consult.com < README > > This fails with the following message in maillog > > Feb  4 11:28:48 klovia dovecot: dict(13122): Error: > mysql(/var/lib/mysql/mysql.sock): Connect failed to database > (postfix): Can't connect to local MySQL server through socket > '/var/lib/mysql/mysql.sock' (13) - waiting for 25 seconds before retry > SELinux denials are logged with auditd: # show some summary (recent = last 10min) aureport --avc --start recent

# if it's the dovecot_t type that spits AVC denials, then you probably could create dummy policy by using the audit2allow tool: ausearch -m AVC --context dovecot_t | audit2allow --reference -m dovecot_mysql_custom

> But I was hoping that there were better tools now with Centos7.  I > checked for setsebool at: > > https://linux.die.net/man/8/mysqld_selinux I would lookup this the other way around: is there a boolean that allows dovecot to connect to mysql? but there doesnt seem to be one: https://github.com/fedora-selinux/selinux-policy-contrib/blob/rawhide/dov... the mysql policy provides an interfacee to allow access to it's socket: https://github.com/fedora-selinux/selinux-policy-contrib/blob/rawhide/mys...

this could be used in the policy allowing the access. - Thomas _______________________________________________ selinux mailing list -- selinux(a)lists.fedoraproject.org To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject...

On 2/5/19 2:52 PM, Robert Moskowitz wrote: > Thank you for replying. > > On 2/5/19 2:06 AM, Thomas Mueller wrote: >> >> On 2/4/19 8:55 PM, Robert Moskowitz wrote: >>> I am working with Centos7: >>> >>> I have configured Dovecot to connect to mysqld via socket: >>> >>> connect = host=/var/lib/mysql/mysql.sock dbname=postfix >>> user=postfix password=Postfix_Database_Password >>> >>> I test sending a message with >>> >>> sendmail -i rgm(a)test.htt-consult.com < README >>> >>> This fails with the following message in maillog >>> >>> Feb  4 11:28:48 klovia dovecot: dict(13122): Error: >>> mysql(/var/lib/mysql/mysql.sock): Connect failed to database >>> (postfix): Can't connect to local MySQL server through socket >>> '/var/lib/mysql/mysql.sock' (13) - waiting for 25 seconds before retry >>> >> SELinux denials are logged with auditd: >> >> # show some summary (recent = last 10min) >> >> aureport --avc --start recent > > A number of dovecot_t errors.  e.g. > > 18. 02/05/2019 08:38:44 dict system_u:system_r:dovecot_t:s0 195 file > getattr unconfined_u:object_r:mysqld_etc_t:s0 denied 578 > > But after I setenforce 0, I see: > > 32. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 195 file > getattr unconfined_u:object_r:mysqld_etc_t:s0 denied 593 > 33. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file > read unconfined_u:object_r:mysqld_etc_t:s0 denied 594 > 34. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file > open unconfined_u:object_r:mysqld_etc_t:s0 denied 594 > 35. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 322 dir > read unconfined_u:object_r:mysqld_etc_t:s0 denied 595 > 36. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 195 file > getattr system_u:object_r:mysqld_etc_t:s0 denied 596 > 37. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file > read system_u:object_r:mysqld_etc_t:s0 denied 597 > 38. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 5 file > open system_u:object_r:mysqld_etc_t:s0 denied 597 > 39. 02/05/2019 08:39:45 dict system_u:system_r:dovecot_t:s0 283 > unix_stream_socket connectto system_u:system_r:mysqld_t:s0 denied 598 > > >> >> # if it's the dovecot_t type that spits AVC denials, then you >> probably could create dummy policy by using the audit2allow tool: >> >> ausearch -m AVC --context dovecot_t | audit2allow --reference -m >> dovecot_mysql_custom > > This throws an error: > > could not open interface info [/var/lib/sepolgen/interface_info] running sepol-ifgen  should fix this

but I really don't know what state the refpolicy is in with Fedora/Redhat. The reply of Zdenek uses CIL (a new way of writing a policy) - i don't know what the default is now and what is best to be used.

On Mon, Feb 4, 2019 at 9:03 PM Robert Moskowitz <rgm(a)htt-consult.com <mailto:rgm@htt-consult.com>> wrote: I am working with Centos7: I have configured Dovecot to connect to mysqld via socket: connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix password=Postfix_Database_Password I test sending a message with sendmail -i rgm(a)test.htt-consult.com <mailto:rgm@test.htt-consult.com> < README This fails with the following message in maillog Feb  4 11:28:48 klovia dovecot: dict(13122): Error: mysql(/var/lib/mysql/mysql.sock): Connect failed to database (postfix): Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (13) - waiting for 25 seconds before retry If I setenforce to 0, the connection works.  So it clearly is an SELinux problem.  I worked on this almost 2 years ago on another system and found: http://zszsit.blogspot.com/2012/12/dovecot-mysql-selinux-issue-on-centos6... But I was hoping that there were better tools now with Centos7.  I checked for setsebool at: https://linux.die.net/man/8/mysqld_selinux and tried: setsebool -P allow_user_mysql_connect 1 But the mail still does not go unless I setenforce to 0. Hi, this boolean allows a different permission - see the manual page: >> If you want to allow users to connect to mysql, you must turn on the allow_user_mysql_connect boolean. Is there someway to get SELinux to allow dovecot (and postfix) to connect to mysqld? While dovecot is allowed to connect to postgresql port, there is no similar permission for mysql: # sesearch -A -s dovecot_t -c tcp_socket -p name_connect | grep sql allow dovecot_t postgresql_port_t:tcp_socket name_connect; However, if this permission is the only one missing, you can simply add it with: # echo '(allow dovecot_t mysqld_port_t (tcp_socket (name_connect)))' > dovecot-mysql.cil # semodule -i dovecot-mysql.cil # sesearch -A -s dovecot_t -c tcp_socket -p name_connect | grep sql allow dovecot_t mysqld_port_t:tcp_socket name_connect; allow dovecot_t postgresql_port_t:tcp_socket name_connect;

thank you _______________________________________________

On Tue, Feb 5, 2019 at 2:54 PM Robert Moskowitz <rgm(a)htt-consult.com&gt; wrote: > > > On 2/5/19 3:23 AM, Zdenek Pytela wrote: > > > > On Mon, Feb 4, 2019 at 9:03 PM Robert Moskowitz <rgm(a)htt-consult.com&gt; wrote: >> I am working with Centos7: >> >> I have configured Dovecot to connect to mysqld via socket: >> >> connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix >> password=Postfix_Database_Password >> >> I test sending a message with >> >> sendmail -i rgm(a)test.htt-consult.com < README >> >> This fails with the following message in maillog >> >> Feb 4 11:28:48 klovia dovecot: dict(13122): Error: >> mysql(/var/lib/mysql/mysql.sock): Connect failed to database (postfix): >> Can't connect to local MySQL server through socket >> '/var/lib/mysql/mysql.sock' (13) - waiting for 25 seconds before retry >> >> If I setenforce to 0, the connection works. So it clearly is an SELinux >> problem. I worked on this almost 2 years ago on another system and found: >> >> http://zszsit.blogspot.com/2012/12/dovecot-mysql-selinux-issue-on-centos6... >> >> But I was hoping that there were better tools now with Centos7. I >> checked for setsebool at: >> >> https://linux.die.net/man/8/mysqld_selinux >> >> and tried: >> >> setsebool -P allow_user_mysql_connect 1 >> >> But the mail still does not go unless I setenforce to 0. > Hi, > > this boolean allows a different permission - see the manual page: >>> If you want to allow users to connect to mysql, you must turn on the allow_user_mysql_connect boolean. >> Is there someway to get SELinux to allow dovecot (and postfix) to >> connect to mysqld? > While dovecot is allowed to connect to postgresql port, there is no similar permission for mysql: > > # sesearch -A -s dovecot_t -c tcp_socket -p name_connect | grep sql > allow dovecot_t postgresql_port_t:tcp_socket name_connect; > > However, if this permission is the only one missing, you can simply add it with: > > # echo '(allow dovecot_t mysqld_port_t (tcp_socket (name_connect)))' > dovecot-mysql.cil > # semodule -i dovecot-mysql.cil > # sesearch -A -s dovecot_t -c tcp_socket -p name_connect | grep sql > allow dovecot_t mysqld_port_t:tcp_socket name_connect; > allow dovecot_t postgresql_port_t:tcp_socket name_connect; > > > Still getting the error. This does not seem to be what is needed. Isn't this to open TCP access where I am using the unix socket interface? Indeed, what Zdenek advised is for allowing to connect via TCP. Could you try the following instead? dnf install selinux-policy-devel

cat >dovecot_mysql.te <<EOF policy_module(dovecot_mysql,1.0.0) gen_require(` type dovecot_t; ') mysql_read_config(dovecot_t) mysql_stream_connect(dovecot_t) EOF

make -f /usr/share/selinux/devel/Makefile dovecot_mysql.pp

semodule -i dovecot_mysql.pp

Robert Moskowitz wrote: > On 2/5/19 10:41 AM, Ondrej Mosnacek wrote: >> cat >dovecot_mysql.te <<EOF >> policy_module(dovecot_mysql,1.0.0) >> gen_require(` >> type dovecot_t; >> ') >> mysql_read_config(dovecot_t) >> mysql_stream_connect(dovecot_t) >> EOF > For some reason this made an empty file.  Don't know if it was the lack of > spaces on that first line?  I use this myself a lot, but always put spaces > around the > and << No need for spaces after >. The issue with the above example is that the HERE-DOC includes "`" chars which bash tries to interpret. It should display an error like this when you run it: -bash: bad substitution: no closing "`" in ` To fix that, use: cat >dovecot_mysql.te <<\EOF ... The change is the \ preceding EOF, telling bash to not perform parameter/command/arithmetic expansions on the HERE-DOC contents.

On Tue, Feb 5, 2019 at 6:57 PM Robert Moskowitz <rgm(a)htt-consult.com&gt; wrote: > On 2/5/19 10:41 AM, Ondrej Mosnacek wrote: >> On Tue, Feb 5, 2019 at 2:54 PM Robert Moskowitz <rgm(a)htt-consult.com&gt; wrote: >>> >>> >>> On 2/5/19 3:23 AM, Zdenek Pytela wrote: >>> >>> >>> >>> On Mon, Feb 4, 2019 at 9:03 PM Robert Moskowitz <rgm(a)htt-consult.com&gt; wrote: >>>> I am working with Centos7: >>>> >>>> I have configured Dovecot to connect to mysqld via socket: >>>> >>>> connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix >>>> password=Postfix_Database_Password >>>> >>>> I test sending a message with >>>> >>>> sendmail -i rgm(a)test.htt-consult.com < README >>>> >>>> This fails with the following message in maillog >>>> >>>> Feb 4 11:28:48 klovia dovecot: dict(13122): Error: >>>> mysql(/var/lib/mysql/mysql.sock): Connect failed to database (postfix): >>>> Can't connect to local MySQL server through socket >>>> '/var/lib/mysql/mysql.sock' (13) - waiting for 25 seconds before retry >>>> >>>> If I setenforce to 0, the connection works. So it clearly is an SELinux >>>> problem. I worked on this almost 2 years ago on another system and found: >>>> >>>> http://zszsit.blogspot.com/2012/12/dovecot-mysql-selinux-issue-on-centos6... >>>> >>>> But I was hoping that there were better tools now with Centos7. I >>>> checked for setsebool at: >>>> >>>> https://linux.die.net/man/8/mysqld_selinux >>>> >>>> and tried: >>>> >>>> setsebool -P allow_user_mysql_connect 1 >>>> >>>> But the mail still does not go unless I setenforce to 0. >>> Hi, >>> >>> this boolean allows a different permission - see the manual page: >>>>> If you want to allow users to connect to mysql, you must turn on the allow_user_mysql_connect boolean. >>>> Is there someway to get SELinux to allow dovecot (and postfix) to >>>> connect to mysqld? >>> While dovecot is allowed to connect to postgresql port, there is no similar permission for mysql: >>> >>> # sesearch -A -s dovecot_t -c tcp_socket -p name_connect | grep sql >>> allow dovecot_t postgresql_port_t:tcp_socket name_connect; >>> >>> However, if this permission is the only one missing, you can simply add it with: >>> >>> # echo '(allow dovecot_t mysqld_port_t (tcp_socket (name_connect)))' > dovecot-mysql.cil >>> # semodule -i dovecot-mysql.cil >>> # sesearch -A -s dovecot_t -c tcp_socket -p name_connect | grep sql >>> allow dovecot_t mysqld_port_t:tcp_socket name_connect; >>> allow dovecot_t postgresql_port_t:tcp_socket name_connect; >>> >>> >>> Still getting the error. This does not seem to be what is needed. Isn't this to open TCP access where I am using the unix socket interface? >> Indeed, what Zdenek advised is for allowing to connect via TCP. Could >> you try the following instead? >> >> dnf install selinux-policy-devel > > Nit this is CentOS7, so yum. In fact it is CentOS7-armhfp... > >> cat >dovecot_mysql.te <<EOF >> policy_module(dovecot_mysql,1.0.0) >> gen_require(` >> type dovecot_t; >> ') >> mysql_read_config(dovecot_t) >> mysql_stream_connect(dovecot_t) >> EOF > > For some reason this made an empty file. Don't know if it was the lack > of spaces on that first line? I use this myself a lot, but always put > spaces around the > and << As other have already pointed out, it was because of the unescaped backtick. I initially started with just the last two lines and later realized the other lines are also needed, so I just vim'd the file and copy-pasted the new contents into the e-mail without checking if it still works :) > > So I just used vi this time. :) > >> make -f /usr/share/selinux/devel/Makefile dovecot_mysql.pp > >> semodule -i dovecot_mysql.pp > > And the sendmail test went through with enforcing. > > thanks! Great! I submitted a PR to allow this in Fedora policy, since it seems like a valid use case. Hopefully it gets to RHEL/CentOS from there eventually. https://github.com/fedora-selinux/selinux-policy-contrib/pull/86

-- Ondrej Mosnacek <omosnace at redhat dot com> Associate Software Engineer, Security Technologies Red Hat, Inc. _______________________________________________ selinux mailing list -- selinux(a)lists.fedoraproject.org To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject...

On 2/6/19 11:04 AM, Lukas Vrabec wrote: > On 2/6/19 10:59 AM, Ondrej Mosnacek wrote: >> On Tue, Feb 5, 2019 at 6:57 PM Robert Moskowitz <rgm(a)htt-consult.com&gt; >> wrote: >>> On 2/5/19 10:41 AM, Ondrej Mosnacek wrote: >>>> On Tue, Feb 5, 2019 at 2:54 PM Robert Moskowitz >>>> <rgm(a)htt-consult.com&gt; wrote: >>>>> >>>>> On 2/5/19 3:23 AM, Zdenek Pytela wrote: >>>>> >>>>> >>>>> >>>>> On Mon, Feb 4, 2019 at 9:03 PM Robert Moskowitz >>>>> <rgm(a)htt-consult.com&gt; wrote: >>>>>> I am working with Centos7: >>>>>> >>>>>> I have configured Dovecot to connect to mysqld via socket: >>>>>> >>>>>> connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix >>>>>> password=Postfix_Database_Password >>>>>> >>>>>> I test sending a message with >>>>>> >>>>>> sendmail -i rgm(a)test.htt-consult.com < README >>>>>> >>>>>> This fails with the following message in maillog >>>>>> >>>>>> Feb  4 11:28:48 klovia dovecot: dict(13122): Error: >>>>>> mysql(/var/lib/mysql/mysql.sock): Connect failed to database >>>>>> (postfix): >>>>>> Can't connect to local MySQL server through socket >>>>>> '/var/lib/mysql/mysql.sock' (13) - waiting for 25 seconds before >>>>>> retry >>>>>> >>>>>> If I setenforce to 0, the connection works.  So it clearly is an >>>>>> SELinux >>>>>> problem.  I worked on this almost 2 years ago on another system >>>>>> and found: >>>>>> >>>>>> http://zszsit.blogspot.com/2012/12/dovecot-mysql-selinux-issue-on-centos6... >>>>>> >>>>>> >>>>>> But I was hoping that there were better tools now with Centos7.  I >>>>>> checked for setsebool at: >>>>>> >>>>>> https://linux.die.net/man/8/mysqld_selinux >>>>>> >>>>>> and tried: >>>>>> >>>>>> setsebool -P allow_user_mysql_connect 1 >>>>>> >>>>>> But the mail still does not go unless I setenforce to 0. >>>>> Hi, >>>>> >>>>> this boolean allows a different permission - see the manual page: >>>>>>> If you want to allow users to connect to mysql, you must turn on >>>>>>> the allow_user_mysql_connect boolean. >>>>>> Is there someway to get SELinux to allow dovecot (and postfix) to >>>>>> connect to mysqld? >>>>> While dovecot is allowed to connect to postgresql port, there is >>>>> no similar permission for mysql: >>>>> >>>>> # sesearch -A -s dovecot_t -c tcp_socket -p name_connect | grep sql >>>>> allow dovecot_t postgresql_port_t:tcp_socket name_connect; >>>>> >>>>> However, if this permission is the only one missing, you can >>>>> simply add it with: >>>>> >>>>> # echo '(allow dovecot_t mysqld_port_t (tcp_socket >>>>> (name_connect)))' > dovecot-mysql.cil >>>>> # semodule -i dovecot-mysql.cil >>>>> # sesearch -A -s dovecot_t -c tcp_socket -p name_connect | grep sql >>>>> allow dovecot_t mysqld_port_t:tcp_socket name_connect; >>>>> allow dovecot_t postgresql_port_t:tcp_socket name_connect; >>>>> >>>>> >>>>> Still getting the error.  This does not seem to be what is >>>>> needed.  Isn't this to open TCP access where I am using the unix >>>>> socket interface? >>>> Indeed, what Zdenek advised is for allowing to connect via TCP. Could >>>> you try the following instead? >>>> >>>> dnf install selinux-policy-devel >>> Nit this is CentOS7, so yum.  In fact it is CentOS7-armhfp... >>> >>>> cat >dovecot_mysql.te <<EOF >>>> policy_module(dovecot_mysql,1.0.0) >>>> gen_require(` >>>>          type dovecot_t; >>>> ') >>>> mysql_read_config(dovecot_t) >>>> mysql_stream_connect(dovecot_t) >>>> EOF >>> For some reason this made an empty file.  Don't know if it was the lack >>> of spaces on that first line?  I use this myself a lot, but always put >>> spaces around the > and << >> As other have already pointed out, it was because of the unescaped >> backtick. I initially started with just the last two lines and later >> realized the other lines are also needed, so I just vim'd the file and >> copy-pasted the new contents into the e-mail without checking if it >> still works :) >> >>> So I just used vi this time.  :) >>> >>>> make -f /usr/share/selinux/devel/Makefile dovecot_mysql.pp >>>> semodule -i dovecot_mysql.pp >>> And the sendmail test went through with enforcing. >>> >>> thanks! >> Great! I submitted a PR to allow this in Fedora policy, since it seems >> like a valid use case. Hopefully it gets to RHEL/CentOS from there >> eventually. >> >> https://github.com/fedora-selinux/selinux-policy-contrib/pull/86 >> > Thanks Ondrej, for PR, it's already merged and back ported to Fedora 28 > and Fedora 29. > > https://github.com/fedora-selinux/selinux-policy-contrib/commit/e7c5f327c... > > > Robert, > > Do you have some more SELinux denials (AVC msgs) in audit.log after > workaround from Ondrej? If yes, please attach it , we can work on them. > looking at https://wiki.dovecot.org/AuthDatabase/SQL I suspect mysql_tcp_connect(dovecot_t) is also neede for someone not using a local db.

- Thomas https://github.com/fedora-selinux/selinux-policy-contrib/blob/rawhide/mys...