Acl problem

[marcinek]

Hi
maybe i`m wrong but , acl`s lacks pipe support :(

here is my postfix acl:

/usr/lib/posfix/smtp {

/ rwxoi

+CAP_ALL

}

Aug 25 15:08:51 kernel: grsec: attempt to load writable library [03:05:32007] by (smtp:26390) UID(101) EUID(101),
+parent (master:5191) UID(0) EUID(0)

debug1: 5:33:30G_NEWKEYS repostfix/qmgr[30510]: warning: private/smtp socket: malformed response


--snip--

learning mode not help , maybe someone have got acl's for postfix

[spender]

that's a pretty ugly ACL (it doesn't restrict anything), but the problem you are having is that postfix is trying to load a library that is writable in the acl for /. Do a find -inum 32007 on the partition that corresponds to the device 03:05 (/dev/hda5 i think) to find the library it was trying to load, and then fix your ACL for / so that write access is not allowed.

-Brad

[marcinek]

ok , here is new lino of acl`s for rw lib :
/var/spool/postfix/lib rwxi

but ....

ug 26 10:49:05 postfix/qmgr[30510]: C928EF2F3: from=<root@intercaffe.metronet.pl>, size=314, nrcpt=1 (queue active)
Aug 26 10:49:05 postfix/smtp[20199]: fatal: unknown service: smtp/tcp
Aug 26 10:49:06 postfix/qmgr[30510]: warning: premature end-of-input from private/smtp socket while reading input attribute name
Aug 26 10:49:06 postfix/qmgr[30510]: warning: private/smtp socket: malformed response

and ..
Here are new errors

[hightower]

ok , here is new lino of acl`s for rw lib :
/var/spool/postfix/lib rwxi

but ....

ug 26 10:49:05 postfix/qmgr[30510]: C928EF2F3: from=<root@intercaffe.metronet.pl>, size=314, nrcpt=1 (queue active)
Aug 26 10:49:05 postfix/smtp[20199]: fatal: unknown service: smtp/tcp
Aug 26 10:49:06 postfix/qmgr[30510]: warning: premature end-of-input from private/smtp socket while reading input attribute name
Aug 26 10:49:06 postfix/qmgr[30510]: warning: private/smtp socket: malformed response

and ..
Here are new errors

Hi Marcinek,

as Brad says:

> ...
> to load, and then fix your ACL for / so that write access is not allowed.

Read it carefully ;-)

It may be helpfull if you post your complete ACL file.

Anyway, this looks like your ACL for postfix is not able to view /etc/services, therefore you get the error of unknown service smtp/tcp.

You should have a rule for / like this:

/ {
...
/etc r
...
}

Even if you don't want this for all, set /etc ro to your postfix ACL.

Also, if you get messages like "grsec: attempt to load writable library ..."
this means, it should _NOT_ have write (w) access to the libraries it uses!

Also +CAP_ALL is not needed. You maybe only want +CAP_NET_BIND_SERVICE.

I am pretty sure the ACL learning stuff will tell you the right things.

ciao, Marc

[marcinek]

Hi again

learning not help , I was create learning objects for all postfix daemons
but this not helps , postfix works fine , but don't send mails :<
I ` m think learning mode not create +CAP_CHROOT , maybe someone have learning mode have got postfix acl?

[spender]

/usr/lib/postfix o {
/var/spool/postfix rw
/dev/null rw
/ h
/dev/log
/etc/aliases
/etc r
/etc/ld.so.cache rx
/lib/ld-2.2.5.so x
/lib rx
/usr/lib rx
/usr/lib/postfix x
/usr/lib/sympa/bin/queue x
/usr/share/zoneinfo/US/Eastern r
/var/mail w
/var/spool/postfix/etc/hosts r
/var/spool/postfix/etc/localtime r
/var/spool/postfix/etc/resolv.conf r
/var/spool/postfix/etc/services r
/var/spool/postfix/lib/libnss_dns-2.2.5.so rx
/var/spool/postfix/lib/libnss_files-2.2.5.so rx
/var/tmp
-CAP_ALL
+CAP_DAC_OVERRIDE
+CAP_KILL
+CAP_SETGID
+CAP_SETUID
+CAP_SYS_CHROOT

connect {
0.0.0.0/0:25 stream tcp
0.0.0.0/0:53 dgram udp
}

bind {
disabled
}
}

[marcinek]

Hi
thx Brad , but this is only acl`s for one daemon , I have a problem with smtp (he don`t send mails) , even in learning mode enabled for all postfix daemons .

[spender]

No, it's for all the postfix daemons. They all live in /usr/lib/postfix. This ACL is for that directory, so it applies to all the daemons.

-Brad

[marcinek]

Hi again

This is new error , maybe i have old version of grsecurity .
"0.0.0.0/0" caused a parse error on line 30 of /etc/grsec/b
My grsecurity cvs date is 24 aug .

[Sea-you]

Spender ur gr8 :D

[marcinek]

Yes he is the best .
All works on new 1.9.7rc3 :D