Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 161716 - dovecot can't access Maildir IMAP under selinux
Summary: dovecot can't access Maildir IMAP under selinux
Alias: None
Product: Fedora
Classification: Fedora
Component: dovecot
Version: 4
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Petr Rockai
QA Contact:
Depends On:
TreeView+ depends on / blocked
Reported: 2005-06-26 15:05 UTC by Adam Thompson
Modified: 2014-01-21 22:52 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2006-01-23 07:22:57 UTC

Attachments (Terms of Use)

Description Adam Thompson 2005-06-26 15:05:47 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

Description of problem:
Dovecot is unable to retrieve emails from user's ~/Maildir/new folder, aka INBOX.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
Selinux in targeted mode,
Postfix delivering mail directly into ~/Maildir,
Dovecot running as targeted daemon,
(Haven't tested any other folders yet, not relevant yet.)

Actual Results:  /etc/audit/audit.log:
type=PATH msg=audit(1119797848.277:8929789): item=0 name="/home/athompso/Maildir/new/" inode=28612110 dev=fd:00 mode=0100600 ouid=500 ogid=500 rdev=00:00
type=SYSCALL msg=audit(1119797848.277:8929789): arch=40000003 syscall=5 success=no exit=-13 a0=8ae5230 a1=8000 a2=0 a3=8000 items=1 pid=7920 auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 comm="imap" exe="/usr/libexec/dovecot/imap"
type=AVC msg=audit(1119797848.277:8929789): avc:  denied  { read } for  pid=7920 comm="imap" dev=dm-0 ino=28612110 scontext=root:system_r:dovecot_t tcontext=root:object_r:user_home_dir_t tclass=file

Expected Results:  Dovecot should have been able to read the messages...

Additional info:

Bizarre.  After relabeling my entire home directory to user_u:object_r:user_home_t (which it wasn't, thanks to restoring from a non-SELinux tape backup) now dovecot can read email...


# chcon -R -u user_u -o object_r -t user_home_t $HOME

(of course, getting yourself into a context where you're allowed to relabel such things can be a hassle too, if you aren't an selinux guru.)

Comment 1 Petr Rockai 2006-01-23 07:22:57 UTC
I suppose the problem was in your home dir labeling, which means not a bug 
(considering that your home dirs were in user identity root instead of 
user_u). If you experience selinux problems in future and they seem to be 
related to system (as opposed to your local policy or labeling), please file 
bugs with appropriate components (that is eg. relevant selinux policy). 

Note You need to log in before you can comment on or make changes to this bug.