OpenEMM with SELinux

We have OpenEMM installed on a CentOS 6 VM.

Emails could be sent fine, but bounce management wasn't working, and worse, it was breaking sendmail as no local mails were getting through. ie root@localhost would not be delivered.

Looking in /var/log/maillog I got this error:


Jun 13 12:00:41 news sendmail[7711]: q5DB0fF9007711: Milter (bav): error connecting to filter: Permission denied
Jun 13 12:00:41 news sendmail[7711]: q5DB0fF9007711: Milter (bav): to error state
Jun 13 12:00:41 news sendmail[7711]: q5DB0fF9007711: Milter: initialization failed, temp failing commands

I guessed that the problem was the connection to the bav filter.  In the sendmail.mc the input mail filter lines points to the bav.sock file:

INPUT_MAIL_FILTER(`bav', `S=unix:/home/openemm/var/run/bav.sock, F=T')dnl

The permissions on the bav.sock file were 0775, so at first I tried changing this to 777, but that had no effect at all.  Then I hit upon the problem.

THE PROBLEM:  SE Linux was enabled, and prevented sendmail talking to the bav filter.

This can be seen in the /var/log/audit/audit.log:


type=AVC msg=audit(1339590098.672:140014): avc:  denied  { connectto } for  pid=8178 comm="sendmail" path="/home/openemm/var/run/bav.sock" scontext=unconfined_u:system_r:sendmail_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1339590098.672:140014): arch=c000003e syscall=42 success=no exit=-13 a0=5 a1=7fff2fdcd6d0 a2=6e a3=7fff2fdcd3e0 items=0 ppid=7697 pid=8178 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=51 sgid=51 fsgid=51 tty=(none) ses=10525 comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=unconfined_u:system_r:sendmail_t:s0 key=(null)


Sendmail was making a request to the bav.sock unix socket, which was being blocked by SELinux, with the result that all incoming emails were being qeueued up, and never being processed.  I proved this by disabling the bav filter in selinux.mc, and I got a flood of incoming mail....

One suggestion I came across was to disable SELinux, which lets face it, really isn't a solution.

THE SOLUTION: I had to create and install an SELinux module to enable this connection.

First I had to install the policycoreutils, this includes the all important audit2allow utility.

yum install policycoreutils-python

Then run the command:

grep sendmail_t /var/log/audit/audit.log | audit2allow -M openemm

This creates 2 files openemm.pp, and openemm.te.

The contents of openemm.te are


module openemm 1.0;

require {
        type sendmail_t;
        type unconfined_t;
        type initrc_t;
        class unix_stream_socket connectto;
}

#============= sendmail_t ==============
allow sendmail_t initrc_t:unix_stream_socket connectto;
allow sendmail_t unconfined_t:unix_stream_socket connectto;

This I guess allows sendmail to connect to a unix socket.

Then I ran the following command to install the module. (make sure you add the .pp extension)

semodule -i openemm.pp

After this everything started working as expected


Update Sept 2012:

Everything still doesn't work as expected, such is life.  Bounce management requires procmail working, and procmail was having issues running the bav process.  I was getting the following error in sendmail:


/home/openemm/bin/scripts/scan_and_unsubscribe: cannot execute binary file


However running the audit2allow again specifying procmail_t, and make sure the output file is procmail2 as procmail already exists as a module.

Useful article on selinux configuration:  http://omotech.com/blog/?p=196


Update April 2014:

After another CentOS update SELinux decided to block access to the sendmail folders in the openemm home directory.   So we had to jump through the audit hoops to get it working again.  This time I combined my previous policy attempts for sendmail/openemm into a single file, compiled the pp file, and upgraded the existing policy.

Here is my latest policy file:

module openemm 4;

require {
type unconfined_t;
type initrc_t;
type sendmail_t;
type setfiles_t;
type ptmx_t;
type home_root_t;
type user_tmp_t;
type user_home_t;
type user_home_dir_t;
class sock_file { getattr read write };
class dir { read write getattr remove_name add_name };
class file { rename open create read write getattr lock unlink };
class lnk_file { read write getattr };
class chr_file { read write getattr };
class unix_stream_socket connectto;
}

#============ setfiles_t ==============
allow setfiles_t ptmx_t:chr_file { read write getattr };

#============= sendmail_t ==============
allow sendmail_t initrc_t:unix_stream_socket connectto;
allow sendmail_t unconfined_t:unix_stream_socket connectto;
allow sendmail_t ptmx_t:chr_file { read write getattr };

allow sendmail_t user_home_dir_t:dir { read write getattr remove_name add_name };
allow sendmail_t user_home_dir_t:file { write getattr read lock unlink open rename create };
allow sendmail_t user_home_dir_t:sock_file { read write getattr };
allow sendmail_t user_home_dir_t:lnk_file { read write getattr };

allow sendmail_t user_home_t:dir { read write getattr remove_name add_name };
allow sendmail_t user_home_t:file { write getattr read lock unlink open rename create };
allow sendmail_t user_home_t:sock_file { read write getattr };
allow sendmail_t user_home_t:lnk_file { read write getattr };

allow sendmail_t user_tmp_t:dir { read write getattr remove_name add_name };
allow sendmail_t user_tmp_t:file { write getattr read lock unlink open rename create };
allow sendmail_t user_tmp_t:sock_file { read write getattr };

I have also created a script file to compile the policy file:


#!/bin/bash
rm openemm.mod
rm openemm.pp
checkmodule -M -m -o openemm.mod openemm.te
semodule_package -m openemm.mod -o openemm.pp

Running the script file creates the openemm.pp file from the openemm.te file.  Provided you change the version number at the top of the policy file (the line saying: module openemm 2.1;) rather than installing another policy it is possible to upgrade the existing policy, with the command:

semodule -u openemm.pp

Useful article on compling polices: melikedev.com
semodule command on Fedora: semodule

Update April 2018:

This has now been updated for OpenEMM 2015 R3,

It has also been added to github

Also its worth noting that sometimes the SELinux context of the files can get all messed up, and the module above doesn't work.  When I upgraded, I first extracted the files to the /tmp folder, which then gave all the files an SE context of usr_tmp_t:

To show all the file security contexts do:

# ls -Z

If you go to /home, and issue the command:

#restorecon openemm

This will reset the security context of the openemm files, back to what they ought to be, i.e. user_home_t and life will be sweeter again.

Inkscape Drop Shadow Using Filters

I like Inkscape. It's a great free program for vector graphics, but it can be a bit confusing at times to do certain things. Like the ubiquitous drop shadow. It ought to be as easy as clicking a button to apply a drop shadow to an image, but alas things are rarely that simple unless you are using a mac, but thats a post for another day.

So how do we do drop shadows in inkscape?

The easy way is to use a duplicate object. So start by creating an object, I just created some text and coloured it red:



Then duplicate that object, Edit -> Duplicate, or Ctrl-D:



Using the fill and stroke options, change the colour to a nice mid tone grey with a bit of transparency:



Use 'pagedown' or the 'lower' icon, to drop the grey text below the red text, and use the magical gaussian blur slider in the fill and stroke options to give us a nice hazy shadow:



Using a little repositioning we get a nice shadow:



But what happens if we need to change the text or if there is a typo? Its a bit of a pain to go through the whole process again, just to reproduce the same effect.



There is a better way using filters

Start with your text object again, then bring up the filters dialog (Object ->Filter Effects), its a bit weird and confusing at first, so we'll go through it step by step. On the left is a list of filters, in the middle are the effects that make up that filter, and on the right are the possible 'input sources' for the effects. At the bottom are the parameters for a particular effect.



Lets create a new filter, click the new button, a new filter will be created, right click and rename it to something more memorable, e.g 'drop shadow'.



Now select the gaussian blur filter from the effects selection list, and click add effect. That was easy, we created our first filter, but we can achieve the same thing using the blur slider in the fill and stroke options panel, but we can do so much more with filters, because we can combine them to produce better and more complicated effects.



There is a line connecting the gaussian blur effect to the 'source graphic' input. In this tutorial we are only concerned with the source graphic and source alpha inputs. With only one effect the source of the blur cannot be changed.

If the text object is selected, then checking the box next to the drop shadow filter will enable or disable the gaussian blur filter on the text.

Ok, we have blurred text, but thats not what we want, we want a shadow, so from the effects list select the 'merge effect', and click add:



Now we have a blur effect and a merge effect, but the text hasn't changed. This is because we need to 'wire up' the inputs of each effect. Attached to each effect is a little triangle, pointing at the text, if you hover the mouse over this triangle you will see it changes colour, indicating it is selectable. If you click and drag on this triangle, a line is drawn to the mouse cursor. This allows you to link the effect with either a different 'input' or another effect. If you click and drag the triangle on the blur effect and 'drop' the line on the 'source alpha' input column, the text will turn fuzzy black, indicating that the gaussian blur is affecting the alpha channel of the text instead of the text itself.



Now we need to wire up the merge effect. Drag the arrow from the merge effect and drop it on the gaussian blur. A little angled line should link the two effects, and a new triangle should appear on the merge effect, drag this second triangle to the 'Source Graphic' input column on the right.



We should now have some red text with a hazy black shadow! This is much better. We can edit the text and the shadow adjusts with the text as it changes. The shadow can be turned on an off with the checkbox next to the filter name. This same filter can be applied to other objects on the page. So if we have any other text or objects on the page, select them and check the drop shadow filter, and hey presto they have shadows too.

But the drop shadow is still not quite right, it needs to be offset from the text, and I want it to be transparent grey not black. To achieve this we need add more effects into the filter. Moving the shadow is easy.

Select the 'Offset' effect, and click 'add effect'. Change the Delta X and Delta Y parameters to 5 pixels or however much you want to offset the shadow by. The offset effect is added at the bottom of the filter, and takes the merge effect as an input, so the result of the merge, ie. the whole graphic, is offset. This is not what we want, we only want to offset the blur.



First, drag the offset effect from the bottom and drop it just underneath the blur, the order of the effects should now be changed, but the connections are messed up.



Drag the connection that goes from the merge effect to the blur effect, and drop it on the offset effect instead, et voila, just the blur is shifted, giving us a nice offset shadow effect.



The shadow is still the wrong colour though. At this stage it seems logical to add the 'Color Matrix' filter to change the colour of the shadow, unfortunately there a 2 problems with this, the first one is that the color matrix filter doesn't have a colorize with alpha option, and second, I cant understand how to use the matrix option as it's too complicated, and I'm not a maths guru. So instead we can use 2 other filters to make the process easier.

Add the 'Flood Filter' and set its colour and alpha values as required, the input will default to the 'Source Graphic', leave this alone. Next add a 'Composite' filter and set its operator to 'In', select the Flood filter as its first input, then the 'Source Graphic' as its second input, then feed this into the blur then offset effects, then finally merge with the source graphic.



Finally we have a drop shadow that can be enabled by the click of a button, and it doesn't matter if we need to change the text or modify the object shape.

If we have an object on the page which requires a different kind of shadow, the easiest thing is to right click on the filter name to duplicate it, rename it eg 'drop shadow 2', modify the settings as appropriate, then apply the second filter to the new object.

The only drawback with these filters is that it isn't possible to save the filter, which is a shame, as there could be a list of predefined filters which could be reused.

Update: Actually you can save the filter as a custom one. Check out Elaine's comment below.