1

SELinux is preventing cron from attaching a log file in the email with the following error:

notice kernel [ 7148.923034] type=1400 audit(1359466501.857:5): avc: denied { read } for pid=3182 comm="mailx" name="attachment" dev="dm-1" ino=4140 scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_log_t:s0 tclass=file

A bash script is run by cron every hour to email a log file if it is not empty. The script contains the following line:

echo "" | mailx -s "Critical Message" -a /var/log/attachment test@email.com

I think the problem has to do with the file security context. I read somewhere that setting the context to public content might help, but not sure if it is a good idea or if there is a better approach.

Improve this question

1 Answer 1

Reset to default
0

You have three options (well, three that I can think of right now):
1. File a bug and wait for an update to the policy package which does allow this.
2. Change the context of the file you're attempting to attach so that SELinux lets it get attached.
3. Put SElinux in permissive mode, so it will log the fact that it wants to deny this action but it won't actually prevent it from happening.

Each option has drawbacks, some perhaps significant, so the route you take will be highly dependent on your environment.

Improve this answer
5
  • or make a policy module that allows cron to access the file.
    – lsd
    Jan 29, 2013 at 16:18
  • I have decided on option 2 to script chcon in the bash script. Can you confirm which is the appropriate security context? system_cron_spool_t or user_cron_spool_t? How to do I go about deciding?
    – Question Overflow
    Jan 30, 2013 at 3:35
  • Neither - the mail process is running as system_mail_t, the file has context var_log_t. You would want to chcon to system_mail_t, send the attachment, then chcon back to var_log_t to avoid problems with future log writes.
    – John
    Jan 30, 2013 at 12:25
  • Are you sure about that that source context must match target context? Because it worked with cron_spool_t but emit SELinux error if I try to chcon to system_mail_t.
    – Question Overflow
    Jan 30, 2013 at 14:24
  • No, I'm not sure - if it works with cron_spool_t, use it, just be sure to set it back at the end of the script.
    – John
    Jan 30, 2013 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.