Re: Problems with selinux and logwatch

Ali Nebi wrote:
> Hi, 
> 
> I have some question about selinux and logwatch.
> 
> 
> I asked in selinux mailing list, and they told me that:
> 
>> 1. Why postdrop try to read, append, get atribute the apache logs. Is
>> can be because we have installed Logwatch program. We get these in all
>> servers.
> This probably means the logwatch program is leaking file descriptors
> when executing postfix.  Logwatch has an open file descriptor to the
> error.log file with append access.  When it executes postfix, it does
> not automatically close the file descriptor,  so SELinux checks the
> access to the open file descriptor when starting postfix,  denies it,
> closes it, reports the avc and continues executing the program.

Interesting. Well the logic of "ouput" from Logwatch is to have an open 
filehandle to STDOUT or the mailer [sendmail, or postfix in your case] 
while the log files are being pushed by "cat" through the various 
filters. So they are partial correct however I don't see why a call to 
/bin/cat error.log would be considered an "append access" file descriptor.

SElinux has been on RHEL4+ for sometime now and we have not heard of 
this problem, although that does not mean it is not valid. Anyone have 
any input on this?


>> 2. I have to allow postdrop to make what is needed with the logs, this
>> is secure and it will not be problem for something?
>>
> No you probably want to dontaudit this, and get logwatch developers to
> fix their code.
> 
> So my questios are:
> 
> 1. Are they really related (these audit messages) with logwatch?
> 2. If there is some solution, can you share with me?
> 
> If this is a bug in logwatch, i just want to inform  about it.
>

What OS and version are you running.

-Mike