Re: SELinux blocking Dovecot from mysqld socket

On 2/6/19 5:04 AM, Lukas Vrabec wrote:
> On 2/6/19 10:59 AM, Ondrej Mosnacek wrote:
>> On Tue, Feb 5, 2019 at 6:57 PM Robert Moskowitz <[email protected]> wrote:
>>> On 2/5/19 10:41 AM, Ondrej Mosnacek wrote:
>>>> On Tue, Feb 5, 2019 at 2:54 PM Robert Moskowitz <[email protected]> wrote:
>>>>>
>>>>> On 2/5/19 3:23 AM, Zdenek Pytela wrote:
>>>>>
>>>>>
>>>>>
>>>>> On Mon, Feb 4, 2019 at 9:03 PM Robert Moskowitz <[email protected]> wrote:
>>>>>> I am working with Centos7:
>>>>>>
>>>>>> I have configured Dovecot to connect to mysqld via socket:
>>>>>>
>>>>>> connect = host=/var/lib/mysql/mysql.sock dbname=postfix user=postfix
>>>>>> password=Postfix_Database_Password
>>>>>>
>>>>>> I test sending a message with
>>>>>>
>>>>>> sendmail -i [email protected] < README
>>>>>>
>>>>>> This fails with the following message in maillog
>>>>>>
>>>>>> Feb  4 11:28:48 klovia dovecot: dict(13122): Error:
>>>>>> mysql(/var/lib/mysql/mysql.sock): Connect failed to database (postfix):
>>>>>> Can't connect to local MySQL server through socket
>>>>>> '/var/lib/mysql/mysql.sock' (13) - waiting for 25 seconds before retry
>>>>>>
>>>>>> If I setenforce to 0, the connection works.  So it clearly is an SELinux
>>>>>> problem.  I worked on this almost 2 years ago on another system and found:
>>>>>>
>>>>>> http://zszsit.blogspot.com/2012/12/dovecot-mysql-selinux-issue-on-centos6.html
>>>>>>
>>>>>> But I was hoping that there were better tools now with Centos7.  I
>>>>>> checked for setsebool at:
>>>>>>
>>>>>> https://linux.die.net/man/8/mysqld_selinux
>>>>>>
>>>>>> and tried:
>>>>>>
>>>>>> setsebool -P allow_user_mysql_connect 1
>>>>>>
>>>>>> But the mail still does not go unless I setenforce to 0.
>>>>> Hi,
>>>>>
>>>>> this boolean allows a different permission - see the manual page:
>>>>>>> If you want to allow users to connect to mysql, you must turn on the allow_user_mysql_connect boolean.
>>>>>> Is there someway to get SELinux to allow dovecot (and postfix) to
>>>>>> connect to mysqld?
>>>>> While dovecot is allowed to connect to postgresql port, there is no similar permission for mysql:
>>>>>
>>>>> # sesearch -A -s dovecot_t -c tcp_socket -p name_connect | grep sql
>>>>> allow dovecot_t postgresql_port_t:tcp_socket name_connect;
>>>>>
>>>>> However, if this permission is the only one missing, you can simply add it with:
>>>>>
>>>>> # echo '(allow dovecot_t mysqld_port_t (tcp_socket (name_connect)))' > dovecot-mysql.cil
>>>>> # semodule -i dovecot-mysql.cil
>>>>> # sesearch -A -s dovecot_t -c tcp_socket -p name_connect | grep sql
>>>>> allow dovecot_t mysqld_port_t:tcp_socket name_connect;
>>>>> allow dovecot_t postgresql_port_t:tcp_socket name_connect;
>>>>>
>>>>>
>>>>> Still getting the error.  This does not seem to be what is needed.  Isn't this to open TCP access where I am using the unix socket interface?
>>>> Indeed, what Zdenek advised is for allowing to connect via TCP. Could
>>>> you try the following instead?
>>>>
>>>> dnf install selinux-policy-devel
>>> Nit this is CentOS7, so yum.  In fact it is CentOS7-armhfp...
>>>
>>>> cat >dovecot_mysql.te <<EOF
>>>> policy_module(dovecot_mysql,1.0.0)
>>>> gen_require(`
>>>>          type dovecot_t;
>>>> ')
>>>> mysql_read_config(dovecot_t)
>>>> mysql_stream_connect(dovecot_t)
>>>> EOF
>>> For some reason this made an empty file.  Don't know if it was the lack
>>> of spaces on that first line?  I use this myself a lot, but always put
>>> spaces around the > and <<
>> As other have already pointed out, it was because of the unescaped
>> backtick. I initially started with just the last two lines and later
>> realized the other lines are also needed, so I just vim'd the file and
>> copy-pasted the new contents into the e-mail without checking if it
>> still works :)
>>
>>> So I just used vi this time.  :)
>>>
>>>> make -f /usr/share/selinux/devel/Makefile dovecot_mysql.pp
>>>> semodule -i dovecot_mysql.pp
>>> And the sendmail test went through with enforcing.
>>>
>>> thanks!
>> Great! I submitted a PR to allow this in Fedora policy, since it seems
>> like a valid use case. Hopefully it gets to RHEL/CentOS from there
>> eventually.
>>
>> https://github.com/fedora-selinux/selinux-policy-contrib/pull/86
>>
> Thanks Ondrej, for PR, it's already merged and back ported to Fedora 28
> and Fedora 29.
>
> https://github.com/fedora-selinux/selinux-policy-contrib/commit/e7c5f327c12dac498cfef69f9a4f9a3d57fa8677
>
> Robert,
>
> Do you have some more SELinux denials (AVC msgs) in audit.log after
> workaround from Ondrej? If yes, please attach it , we can work on them.

My delay in responding was because of a lack of testing as I fought with 
an amavis problem that I caused myself with a postfix configuration.  
All fixed now and I have not seen anymore SELinux denials.  So for me, 
we got this one.

As for other users of Dovecot/mysql, many use the more resource 
expensive TCP connection (or they have Dovecot and mysql on different 
systems), thus the TCP policy should also be standard:

# echo '(allow dovecot_t mysqld_port_t (tcp_socket (name_connect)))' > 
dovecot-mysql.cil
# semodule -i dovecot-mysql.cil

And by merging, does this mean that at some future, people like me will 
not need to do anything, or will there be something that has to be 
turned on (a boolean or such)?

thanks
_______________________________________________
selinux mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]