Re: [gentoo-hardened] SELinux - courier-imap

Hi.

I knew (according to old posts on the list) that other people were  
interessted in these fixes, so the topic name modification !

However, I still have a small problem that would prevent the whole  
thing from working :

With shell operations like
semanage fcontext -a -s system_u -t courier_var_run_t '/var/run/imapd.*'
semanage fcontext -a -s system_u -t courier_var_run_t '/var/run/pop3.*'
semanage fcontext -a -s system_u -t courier_authdaemon_var_run_t  
'/var/run/authdaemon?*

and then a restorecon /var/run/*,
the files are correctly labelled for courier-imap.

But either when rebooting or after an unprecised amount of time (ie  
refreshing operations, maybe), the files are no more correctly  
labelled (var_run_t).

So, it means that the daemons do not care about what I told and that  
they change the files type. How can this be fixed ?

After that, I think that courier-imap will be okay (I will checked on  
the unpatched pop version). But if some people are looking for postfix  
fixes (I have problem with SMTP too), I will try to fix that later (ie  
maybe not today :D)

-- Julien Thomas

John Huttley <John@×××××××××××××××.nz> a écrit :

> I'm glad you are fixiing this since I'm using it as a basis for a new
> cyrus-imapd policy!!
>
> --john
>
>
> julien.thomas@×××××××××××××.fr wrote:
>> Hi.
>> The problems of courier-imap began to be solved ...
>>
>> (The previous post where labelled by "SELinux - network streams"
>> but as I am more focused with courier-imap now, I though it was
>> good to change the subject)
>>
>> However, here is the problem I have with file labelling :
>>
>> I put it /etc/security/selinx/file_contexts the following lines
>> /var/run/impad.*  system_u:object_r:courier_var_run_t
>> /var/run/pop3.*  system_u:object_r:courier_var_run_t
>> /var/run/authdaemon.*  system_u:object_r:courier_var_run_t
>>
>> as the previous ones (/var/run/courier(/.*)?) where wrong.
>>
>> However, restorecon do not give the good contexts for these files
>> (var_run_t). Besides, when the server are restarted or after let's
>> say one hour,
>> the files got the var_run_t context though I changed them with chcon.
>>
>> Where should I put this file_context information.
>> (Do I have to add this I a QuickFix module ?)
>>
>> for the other problem, It was due to transition problems.
>> I have added the following lines :
>> type_transition initrc_t courier_exec_t:process courier_tcpd_t;
>> type_transition courier_tcpd_t courier_authdaemon_exec_t:process
>> courier_authdaemon_t;
>>
>> Julien Thomas.
>>
> --
> gentoo-hardened@g.o mailing list



-- 
gentoo-hardened@g.o mailing list