0

On my CentOS 7 system I am trying to run dovecot with TLS required. For that, I created my private key and certificate in

[root@homeserver /]# ls -lZ indernet/cert/homeserver.*
-r--r--r--. root certuser system_u:object_r:default_t:s0   indernet/cert/homeserver.crt
-r--r-----. root certuser system_u:object_r:default_t:s0   indernet/cert/homeserver.key
[root@homeserver /]#

To make dovecot actually load the files I ensured /etc/dovecot/conf.d/10-ssl.conf contains these lines:

ssl=required
ssl_key=</indernet/cert/homeserver.key
ssl_cert=</indernet/cert/homeserver.crt

The problematic part: Dovecot cannot start up, it fails with this error:

dovecot: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 14: ssl_key: Can't open file /indernet/cert/homeserver.key: Permission denied

I tried to modify the certificate's and key's file permissions (this should not be required according to https://doc.dovecot.org/configuration_manual/dovecot_ssl_configuration/), even to 777 and nothing changes. Someone suggested me it might be SELinux preventing the access and I configured unconfined_u:object_r:default_t:s0 as well as system_u:object_r:default_t:s0 as you can see above. No change.

Now the surprising part: I got very curious and edited /usr/lib/systemd/system/dovecot.service to contain

ExecStart=/bin/strace /usr/sbin/dovecot

and then in /var/log/messages I could see the cert and key getting accessed and loaded. And dovecot works. But when I remove the strace again, I am left with the same problem.

What may be going on here?

Hiran Chaudhuri
  • 113
  • 1
  • 7

1 Answers1

3

The keys cannot be read because SELinux has denied access to them.

To fix the problem, copy (using cp or mv -Z) the keys to a directory where SELinux expects TLS keys and certificates to be stored, i.e. /etc/pki/tls and its subdirectories. The new files will have the correct SELinux contexts if you used cp or mv -Z. Then update the files' locations in your Dovecot configuration.

Michael Hampton
  • 244,070
  • 43
  • 506
  • 972
  • The solution did indeed work. But how come that strace can circumvent SELinux? – Hiran Chaudhuri Aug 29 '21 at 20:13
  • @HiranChaudhuri SELinux allows strace to do just about everything. – Michael Hampton Aug 29 '21 at 22:54
  • This sounds strange, as others even use strace to debug permission problems (https://subscription.packtpub.com/book/networking_and_servers/9781783989669/8/ch08lvl1sec75/using-strace-to-clarify-permission-issues). Is there somewhere more information about this? – Hiran Chaudhuri Aug 30 '21 at 18:42