Allow SeLinux to specific user can send email

Question

I'm trying to allow user zabbix to send email using ssmtps. I've configured everything except SeLinux. For SeLinux booleans there is no such item available for zabbix like httpd_can_sendmail. PS: I can' send email when disable SeLinux. But I don't want to solve as this way.

--------------------------------
UPDATE [PROBLEM SOLVED]
--------------------------------
I solved it as following steps. I think it can solve many SeLinux related problems as this way if you have enabled audit logging.
1. tail -f /var/log/audit/audit.log | grep zabbix | grep denied >> /tmp/zabbix_mail_1
2. Try send email through zabbix user.
3. Wait 2nd step's status, then cat /tmp/zabbix_mail_1 | audit2allow -M zabbix_mail_1 It will generate two files zabbix_mail_1.te and zabbix_mail_1.pp in current directory
4. semodule -i zabbix_mail_1.pp
5. Loop above steps until there is no error on /var/log/audit/audit.log. You can increase index /tmp/zabbix_mail_1 for next steps for the track what did you do.

Answer 1

Tool to view SELinux log information along with commands to allow the blocked command/process.

yum install setroubleshoot-server

Then to review the log

sealert -a /var/log/audit/audit.log

Example output:

    *****  Plugin public_content (32.5 confidence) suggests   ********************

If you want to treat framework.css as public content
Then you need to change the label on framework.css to public_content_t or public_content_rw_t.
Do
# semanage fcontext -a -t public_content_t '/var/www/html/framework.css'
# restorecon -v '/var/www/html/framework.css'

*****  Plugin catchall (4.5 confidence) suggests   ***************************

If you believe that smbd should be allowed getattr access on the framework.css file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'smbd' --raw | audit2allow -M my-smbd
# semodule -i my-smbd.pp

As you can see above it is complaining about framework.css and provides a solution to allow.

Note - OS was not included so i assumed RHEL.

Answer 2

--------------------------------
[PROBLEM SOLVED]
--------------------------------
I solved it as following steps. This blog helped me. I think it can solve many SeLinux related problems as this way if you have enabled audit logging.
1. tail -f /var/log/audit/audit.log | grep zabbix | grep denied >> /tmp/zabbix_mail_1
2. Try send email through zabbix user.
3. Wait 2nd step's status, then cat /tmp/zabbix_mail_1 | audit2allow -M zabbix_mail_1 It will generate two files zabbix_mail_1.te and zabbix_mail_1.pp in current directory
4. semodule -i zabbix_mail_1.pp
5. Loop above steps until there is no error on /var/log/audit/audit.log. You can increase index /tmp/zabbix_mail_1 for next steps for the track what did you do.