How do I modify SELinux to allow OpenDKIM to write to /var/tmp?

Question

I tried this answer (https://serverfault.com/a/744756/123651) but it still gives an error.

Jan 7 23:56:33 ip-172-31-15-65 opendkim[24223]: AF15521407: dkim_eoh(): resource unavailable: can't create temporary file at /var/tmp/dkim.AF15521407.ennuJK: Permission denied

Here are some of the audit.log

type=AVC msg=audit(1483827348.024:363280): avc:  denied  { write } for  pid=22334 comm="opendkim" name="tmp" dev=xvde ino=40961 scontext=unconfined_u:system_r:dkim_milter_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
type=SYSCALL msg=audit(1483827348.024:363280): arch=c000003e syscall=2 success=no exit=-13 a0=7f7eecd1f910 a1=c2 a2=180 a3=0 items=0 ppid=22035 pid=22334 auid=0 uid=495 gid=495 euid=495 suid=495 fsuid=495 egid=495 sgid=495 fsgid=495 tty=(none) ses=4038 comm="opendkim" exe="/usr/sbin/opendkim" subj=unconfined_u:system_r:dkim_milter_t:s0 key=(null)

# cat opendkim.te

module opendkim 1.0;

require {
        type tmp_t;
        type dkim_milter_t;
        class dir write;
}

#============= dkim_milter_t ==============
#!!!! The source type 'dkim_milter_t' can write to a 'dir' of the following types:
# dkim_milter_data_t, cluster_var_lib_t, cluster_var_run_t, root_t, cluster_conf_t

allow dkim_milter_t tmp_t:dir write;

# semodule -i opendkim.pp

# ls -ldZ /var/tmp
drwxrwxrwt. root root system_u:object_r:tmp_t:s0       /var/tmp

# service opendkim restart
Stopping OpenDKIM Milter:                                  [  OK  ]
Starting OpenDKIM Milter:                                  [  OK  ]

I don't know what else to try.

Reference: I used this guide: https://www.rosehosting.com/blog/how-to-install-and-integrate-opendkim-with-postfix-on-a-centos-6-vps/

CentOS release 6.8 (Final)

score 3 · Accepted Answer · answered Jan 08 '17 at 02:42

3

There is no need to allow OpenDKIM to write to any other directories. Just write to the default temporary directory, /var/run/opendkim, which should already exist and have the correct SELinux context to allow it to be written to.

answered Jan 08 '17 at 02:42

Michael Hampton

244,070
43
506
972

Interesting, that dir does exist, however it wasn't used in the guide mentioned for the `TemporaryDirectory`. – Chloe Jan 10 '17 at 20:23
2

@Chloe There are all sorts of bad guides out there. In fact, most of them have errors or problems. – Michael Hampton Jan 10 '17 at 20:26

score 0 · Answer 2 · answered Jan 22 '17 at 07:11

I think what Michael Hampton♦ said is the best solution.

But what if you really need set Temporary to /var/tmp

Then you can try below.

We need to modify the policy what dkim_milter_t had originally. so, create a .te file (example opendkim.te below)
Let dkim_milter_t have permission to access tmp_t what type that dir /var/tmp/ is.

# ll -Zd /var/tmp/ drwxrwxrwt. root root system_u:object_r:tmp_t:s0 /var/tmp/

file may looks like below

module opendkim 1.0;

require {
        type tmp_t;
        type dkim_milter_t;
        class dir { write remove_name add_name };
        class file { write create unlink open };
}
allow dkim_milter_t tmp_t:dir { write remove_name add_name };
allow dkim_milter_t tmp_t:file { write create unlink open };

Of course you can change it suitable. but i think it is what you need least. It actually give the permission to dkim_milter_t to write remove create open file from /var/tmp/

Regenerate opendkim.pp manually

checkmodule -M -m -o opendkim.mod opendkim.te

semodule_package -o opendkim.pp -m opendkim.mod
Enable change

semodule -i opendkim.pp

Maybe you need further more help here. And for man.

score -3 · Answer 3 · answered Jan 08 '17 at 01:50

# setenforce permissive
# service opendkim restart
... send mail to myself ...
# setenforce enforcing
# grep opendkim /var/log/audit/audit.log | audit2allow -M opendkim
# cat opendkim.te

module opendkim 1.0;

require {
        type tmp_t;
        type dkim_milter_t;
        type sysctl_vm_t;
        class dir { write remove_name search add_name };
        class file { write read create unlink open };
}

#============= dkim_milter_t ==============
allow dkim_milter_t sysctl_vm_t:dir search;
allow dkim_milter_t sysctl_vm_t:file read;

#!!!! This avc is allowed in the current policy
allow dkim_milter_t tmp_t:dir write;
allow dkim_milter_t tmp_t:dir { remove_name add_name };
#!!!! The source type 'dkim_milter_t' can write to a 'file' of the following types:
# dkim_milter_data_t, cluster_var_lib_t, cluster_var_run_t, root_t, cluster_conf_t

allow dkim_milter_t tmp_t:file { write create unlink open };

# semodule -i opendkim.pp

@Chloe Did you intend to post this an an answer? I don't think so. — EEAA, Jan 11 '17 at 20:12

How do I modify SELinux to allow OpenDKIM to write to /var/tmp?

3 Answers3

Linked

Related