#18 qmailadmin with selinux (addition to FAQ)

[Nerijus Baliūnas]

If you get "cannot read assign file" when logging in,
it means SELinux (as in Fedora Core 3 for example) does
not let the qmailadmin cgi script to read/write some
files. I watched /var/log/messages for "avc: denied"
messages, and found the rules needed to create and
delete an account:

yum install selinux-policy-targeted-sources
cd /etc/selinux/targeted/src/policy
vi domains/misc/local.te
paste the following 3 lines:

allow httpd_sys_script_t var_t:lnk_file { read };
allow httpd_sys_script_t user_home_t:dir { search read
getattr write add_name remove_name create setattr rmdir };
allow httpd_sys_script_t user_home_t:file { read write
getattr create setattr rename lock unlink };

make reload
service httpd restart

Or, instead of the above, you can change the types of
files and directories which qmailadmin touches with:

chcon -t httpd_sys_script_rw_t <files and directories>

[Nerijus Baliūnas]

Logged In: YES
user_id=3416

The 3rd "allow" line should have 'append' also:
allow httpd_sys_script_t user_home_t:file { read write
getattr create setattr rename lock unlink append };

[Matt Brookings]

Thank you