Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

SELinux is preventing cron from attaching a log file in the email with the following error:

notice kernel [ 7148.923034] type=1400 audit(1359466501.857:5): avc: denied { read } for pid=3182 comm="mailx" name="attachment" dev="dm-1" ino=4140 scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_log_t:s0 tclass=file

A bash script is run by cron every hour to email a log file if it is not empty. The script contains the following line:

echo "" | mailx -s "Critical Message" -a /var/log/attachment test@email.com

I think the problem has to do with the file security context. I read somewhere that setting the context to public content might help, but not sure if it is a good idea or if there is a better approach.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

You have three options (well, three that I can think of right now):
1. File a bug and wait for an update to the policy package which does allow this.
2. Change the context of the file you're attempting to attach so that SELinux lets it get attached.
3. Put SElinux in permissive mode, so it will log the fact that it wants to deny this action but it won't actually prevent it from happening.

Each option has drawbacks, some perhaps significant, so the route you take will be highly dependent on your environment.

share|improve this answer
    
or make a policy module that allows cron to access the file. –  lsd Jan 29 '13 at 16:18
    
I have decided on option 2 to script chcon in the bash script. Can you confirm which is the appropriate security context? system_cron_spool_t or user_cron_spool_t? How to do I go about deciding? –  Question Overflow Jan 30 '13 at 3:35
    
Neither - the mail process is running as system_mail_t, the file has context var_log_t. You would want to chcon to system_mail_t, send the attachment, then chcon back to var_log_t to avoid problems with future log writes. –  John Jan 30 '13 at 12:25
    
Are you sure about that that source context must match target context? Because it worked with cron_spool_t but emit SELinux error if I try to chcon to system_mail_t. –  Question Overflow Jan 30 '13 at 14:24
    
No, I'm not sure - if it works with cron_spool_t, use it, just be sure to set it back at the end of the script. –  John Jan 30 '13 at 14:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.