2

I tried this answer (https://serverfault.com/a/744756/123651) but it still gives an error.

Jan 7 23:56:33 ip-172-31-15-65 opendkim[24223]: AF15521407: dkim_eoh(): resource unavailable: can't create temporary file at /var/tmp/dkim.AF15521407.ennuJK: Permission denied

Here are some of the audit.log

type=AVC msg=audit(1483827348.024:363280): avc:  denied  { write } for  pid=22334 comm="opendkim" name="tmp" dev=xvde ino=40961 scontext=unconfined_u:system_r:dkim_milter_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir
type=SYSCALL msg=audit(1483827348.024:363280): arch=c000003e syscall=2 success=no exit=-13 a0=7f7eecd1f910 a1=c2 a2=180 a3=0 items=0 ppid=22035 pid=22334 auid=0 uid=495 gid=495 euid=495 suid=495 fsuid=495 egid=495 sgid=495 fsgid=495 tty=(none) ses=4038 comm="opendkim" exe="/usr/sbin/opendkim" subj=unconfined_u:system_r:dkim_milter_t:s0 key=(null)

# cat opendkim.te

module opendkim 1.0;

require {
        type tmp_t;
        type dkim_milter_t;
        class dir write;
}

#============= dkim_milter_t ==============
#!!!! The source type 'dkim_milter_t' can write to a 'dir' of the following types:
# dkim_milter_data_t, cluster_var_lib_t, cluster_var_run_t, root_t, cluster_conf_t

allow dkim_milter_t tmp_t:dir write;

# semodule -i opendkim.pp

# ls -ldZ /var/tmp
drwxrwxrwt. root root system_u:object_r:tmp_t:s0       /var/tmp

# service opendkim restart
Stopping OpenDKIM Milter:                                  [  OK  ]
Starting OpenDKIM Milter:                                  [  OK  ]

I don't know what else to try.

Reference: I used this guide: https://www.rosehosting.com/blog/how-to-install-and-integrate-opendkim-with-postfix-on-a-centos-6-vps/

CentOS release 6.8 (Final)

3

There is no need to allow OpenDKIM to write to any other directories. Just write to the default temporary directory, /var/run/opendkim, which should already exist and have the correct SELinux context to allow it to be written to.

| improve this answer | |
  • Interesting, that dir does exist, however it wasn't used in the guide mentioned for the TemporaryDirectory. – Chloe Jan 10 '17 at 20:23
  • 2
    @Chloe There are all sorts of bad guides out there. In fact, most of them have errors or problems. – Michael Hampton Jan 10 '17 at 20:26
0

I think what Michael Hampton♦ said is the best solution.

But what if you really need set Temporary to /var/tmp

Then you can try below.

  1. We need to modify the policy what dkim_milter_t had originally. so, create a .te file (example opendkim.te below)

  2. Let dkim_milter_t have permission to access tmp_t what type that dir /var/tmp/ is.

    # ll -Zd /var/tmp/ drwxrwxrwt. root root system_u:object_r:tmp_t:s0 /var/tmp/

file may looks like below

module opendkim 1.0;

require {
        type tmp_t;
        type dkim_milter_t;
        class dir { write remove_name add_name };
        class file { write create unlink open };
}
allow dkim_milter_t tmp_t:dir { write remove_name add_name };
allow dkim_milter_t tmp_t:file { write create unlink open };

Of course you can change it suitable. but i think it is what you need least. It actually give the permission to dkim_milter_t to write remove create open file from /var/tmp/

  1. Regenerate opendkim.pp manually

    checkmodule -M -m -o opendkim.mod opendkim.te

    semodule_package -o opendkim.pp -m opendkim.mod

  2. Enable change

    semodule -i opendkim.pp

Maybe you need further more help here. And for man.

| improve this answer | |
-3
# setenforce permissive
# service opendkim restart
... send mail to myself ...
# setenforce enforcing
# grep opendkim /var/log/audit/audit.log | audit2allow -M opendkim
# cat opendkim.te

module opendkim 1.0;

require {
        type tmp_t;
        type dkim_milter_t;
        type sysctl_vm_t;
        class dir { write remove_name search add_name };
        class file { write read create unlink open };
}

#============= dkim_milter_t ==============
allow dkim_milter_t sysctl_vm_t:dir search;
allow dkim_milter_t sysctl_vm_t:file read;

#!!!! This avc is allowed in the current policy
allow dkim_milter_t tmp_t:dir write;
allow dkim_milter_t tmp_t:dir { remove_name add_name };
#!!!! The source type 'dkim_milter_t' can write to a 'file' of the following types:
# dkim_milter_data_t, cluster_var_lib_t, cluster_var_run_t, root_t, cluster_conf_t

allow dkim_milter_t tmp_t:file { write create unlink open };

# semodule -i opendkim.pp
| improve this answer | |
  • Please expand on your solution and explain it, thanks! – sebix Jan 8 '17 at 9:27
  • I have no idea what's going on. – Chloe Jan 10 '17 at 20:31
  • @Chloe Did you intend to post this an an answer? I don't think so. – EEAA Jan 11 '17 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.