Re: SELinux blocking Dovecot from mysqld socket

On 2/4/19 8:55 PM, Robert Moskowitz wrote:
> I am working with Centos7:
>
> I have configured Dovecot to connect to mysqld via socket:
>
> connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix 
> password=Postfix_Database_Password
>
> I test sending a message with
>
> sendmail -i [email protected] < README
>
> This fails with the following message in maillog
>
> Feb  4 11:28:48 klovia dovecot: dict(13122): Error: 
> mysql(/var/lib/mysql/mysql.sock): Connect failed to database 
> (postfix): Can't connect to local MySQL server through socket 
> '/var/lib/mysql/mysql.sock' (13) - waiting for 25 seconds before retry
>
SELinux denials are logged with auditd:

# show some summary (recent = last 10min)

aureport --avc --start recent

# if it's the dovecot_t type that spits AVC denials, then you probably 
could create dummy policy by using the audit2allow tool:

ausearch -m AVC --context dovecot_t | audit2allow --reference -m 
dovecot_mysql_custom


> But I was hoping that there were better tools now with Centos7.  I 
> checked for setsebool at:
>
> https://linux.die.net/man/8/mysqld_selinux 

I would lookup this the other way around: is there a boolean that allows 
dovecot to connect to mysql?

but there doesnt seem to be one: 
https://github.com/fedora-selinux/selinux-policy-contrib/blob/rawhide/dovecot.te

the mysql policy provides an interfacee to allow access to it's socket:

https://github.com/fedora-selinux/selinux-policy-contrib/blob/rawhide/mysql.if#L107

this could be used in the policy allowing the access.

- Thomas

_______________________________________________
selinux mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]