Re: Problems with selinux and logwatch

Mike Tremaine wrote:
> Ali Nebi wrote:
>> Hi, 
>>
>> I have some question about selinux and logwatch.
>>
>>
>> I asked in selinux mailing list, and they told me that:
>>
>>> 1. Why postdrop try to read, append, get atribute the apache logs. Is
>>> can be because we have installed Logwatch program. We get these in all
>>> servers.
>> This probably means the logwatch program is leaking file descriptors
>> when executing postfix.  Logwatch has an open file descriptor to the
>> error.log file with append access.  When it executes postfix, it does
>> not automatically close the file descriptor,  so SELinux checks the
>> access to the open file descriptor when starting postfix,  denies it,
>> closes it, reports the avc and continues executing the program.
> 
> Interesting. Well the logic of "ouput" from Logwatch is to have an open 
> filehandle to STDOUT or the mailer [sendmail, or postfix in your case] 
> while the log files are being pushed by "cat" through the various 
> filters. So they are partial correct however I don't see why a call to 
> /bin/cat error.log would be considered an "append access" file descriptor.
> 
> SElinux has been on RHEL4+ for sometime now and we have not heard of 
> this problem, although that does not mean it is not valid. Anyone have 
> any input on this?
> 
>

Just to add more info this means we are doing something like

open(OUTFILE,"|$Config{'mailer'}")
/bin/cat error_log | /usr/bin/perl perl_filter.pl >> OUTFILE
close OUTFILE

If that is illegal in SElinux then we would have to change the main 
script so that we append everything to a temp file before we push it to 
the mailer.

-Mike