https://bugzilla.suse.com/show_bug.cgi?id=1219364 Bug ID: 1219364 Summary: [SELinux] AVC denial dovecot Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team@suse.de Reporter: mcepl@suse.com QA Contact: qa-bugs@suse.de Target Milestone: --- Found By: --- Blocker: --- I have dovecot running on localhost of my workstation, and when switching to SELinux on new Tumbleweed machine, I got this: mitmanek:~ # ausearch -m AVC -ts 22:30 |grep -v -i apparmor|grep dovecot type=AVC msg=audit(1706651785.442:142): avc: denied { search } for pid=20932 comm="auth" name="logins" dev="nvme0n1p3" ino=145649 scontext=system_u:system_r:dovecot_auth_t:s0 tcontext=system_u:object_r:selinux_login_config_t:s0 tclass=dir permissive=1 type=AVC msg=audit(1706651785.446:143): avc: denied { read } for pid=20932 comm="auth" name="unconfined_u" dev="nvme0n1p3" ino=145643 scontext=system_u:system_r:dovecot_auth_t:s0 tcontext=system_u:object_r:default_context_t:s0 tclass=file permissive=1 type=AVC msg=audit(1706651785.446:144): avc: denied { open } for pid=20932 comm="auth" path="/etc/selinux/targeted/contexts/users/unconfined_u" dev="nvme0n1p3" ino=145643 scontext=system_u:system_r:dovecot_auth_t:s0 tcontext=system_u:object_r:default_context_t:s0 tclass=file permissive=1 type=AVC msg=audit(1706651785.446:145): avc: denied { getattr } for pid=20932 comm="auth" path="/etc/selinux/targeted/contexts/users/unconfined_u" dev="nvme0n1p3" ino=145643 scontext=system_u:system_r:dovecot_auth_t:s0 tcontext=system_u:object_r:default_context_t:s0 tclass=file permissive=1 type=AVC msg=audit(1706651785.446:146): avc: denied { setexec } for pid=20932 comm="auth" scontext=system_u:system_r:dovecot_auth_t:s0 tcontext=system_u:system_r:dovecot_auth_t:s0 tclass=process permissive=1 type=AVC msg=audit(1706651785.446:148): avc: denied { setkeycreate } for pid=20932 comm="auth" scontext=system_u:system_r:dovecot_auth_t:s0 tcontext=system_u:system_r:dovecot_auth_t:s0 tclass=process permissive=1 mitmanek:~ # Moved `dovecot_t` to the permissive domains. I believe labels should be correct (relabelled whole system just not that long time ago). -- You are receiving this mail because: You are on the CC list for the bug.