![CentOS7 postfix 安装,selinux 块清理](https://linux22.com/image/705492/CentOS7%20postfix%20%E5%AE%89%E8%A3%85%EF%BC%8Cselinux%20%E5%9D%97%E6%B8%85%E7%90%86.png)
我成功安装了 postfix,当我以 root/sudo 身份启动它时 -
postfix start
...它不受限制地运行并发送电子邮件。
当我将其设置为在启动时自动启动时-
systemctl enable postfix.service
...它在启动时启动并且运行良好,但发送电子邮件被 selinux 阻止。
发送电子邮件时,日志显示-
Jun 6 11:12:20 mainbox kernel: [ 1045.572306] type=1400 audit(1496761940.747:254): avc: denied { read write } for pid=970 comm="cleanup" name="unix.cleanup" dev="xvda1" ino=131013 scontext=system_u:system_r:postfix_cleanup_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file
Jun 6 11:12:20 mainbox kernel: [ 1045.592045] type=1300 audit(1496761940.747:254): arch=c000003e syscall=2 success=no exit=-13 a0=7f3eae371020 a1=2 a2=0 a3=3 items=0 ppid=811 pid=970 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cleanup" exe="/usr/libexec/postfix/cleanup" subj=system_u:system_r:postfix_cleanup_t:s0 key=(null)
Jun 6 11:12:20 mainbox kernel: type=1400 audit(1496761940.747:254): avc: denied { read write } for pid=970 comm="cleanup" name="unix.cleanup" dev="xvda1" ino=131013 scontext=system_u:system_r:postfix_cleanup_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file
Jun 6 11:12:20 mainbox kernel: type=1300 audit(1496761940.747:254): arch=c000003e syscall=2 success=no exit=-13 a0=7f3eae371020 a1=2 a2=0 a3=3 items=0 ppid=811 pid=970 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cleanup" exe="/usr/libexec/postfix/cleanup" subj=system_u:system_r:postfix_cleanup_t:s0 key=(null)
Jun 6 11:12:20 mainbox postfix/cleanup[970]: fatal: open lock file pid/unix.cleanup: cannot open file: Permission denied
Jun 6 11:12:21 mainbox postfix/master[811]: warning: process /usr/libexec/postfix/cleanup pid 970 exit status 1
Jun 6 11:12:21 mainbox postfix/master[811]: warning: /usr/libexec/postfix/cleanup: bad command startup -- throttling
所以我用 a2a 尝试修复它,但我收到警告说新规则太宽松了-
grep 'postfix_cleanup_t' /var/log/audit/audit.log | audit2allow -m postfix_cleanup > postfix_cleanup.te
cat postfix_cleanup.te
生产-
module postfix_cleanup 1.0;
require {
type var_run_t;
type postfix_cleanup_t;
class file { read write };
}
#============= postfix_cleanup_t ==============
#!!!! WARNING: 'var_run_t' is a base type.
allow postfix_cleanup_t var_run_t:file { read write };
...允许 postfix 在整个基类型上运行太过宽松。
如何正确修复此问题?
答案1
Postfix 中缺少上下文的特定文件
有几个错误围绕这一点。您的 selinux 策略是否已完全更新?
文件丢失上下文
如果文件丢失上下文,这很可能是由于restorecond
服务未运行且文件被移动造成的。