12.4. Configuration Examples

Procedure 12.1. Running SpamAssassin on a non-default port

1. Run the semanage command to show the port that SELinux allows spamd to listen on by default:

   ~]# semanage port -l | grep spamd
   spamd_port_t		tcp	783
   

   Copy to Clipboard Toggle word wrap
   This output shows that TCP/783 is defined in spamd_port_t as the port for SpamAssassin to operate on.
2. Edit the /etc/sysconfig/spamassassin configuration file and modify it so that it will start SpamAssassin on the example port TCP/10000:

   # Options to spamd
   SPAMDOPTIONS="-d -p 10000 -c m5 -H"
   

   Copy to Clipboard Toggle word wrap
   This line now specifies that SpamAssassin will operate on port 10000. The rest of this example will show how to modify SELinux policy to allow this socket to be opened.
3. Start SpamAssassin and an error message similar to the following will appear:

   ~]# service spamassassin start
   Starting spamd: [2203] warn: server socket setup failed, retry 1: spamd: could not create INET socket on 127.0.0.1:10000: Permission denied
   [2203] warn: server socket setup failed, retry 2: spamd: could not create INET socket on 127.0.0.1:10000: Permission denied
   [2203] error: spamd: could not create INET socket on 127.0.0.1:10000: Permission denied
   spamd: could not create INET socket on 127.0.0.1:10000: Permission denied
                                                              [FAILED]
   

   Copy to Clipboard Toggle word wrap
   This output means that SELinux has blocked access to this port.
4. A denial similar to the following will be logged by SELinux:

   SELinux is preventing the spamd (spamd_t) from binding to port 10000.
   

   Copy to Clipboard Toggle word wrap
5. As the root user, run semanage to modify SELinux policy in order to allow SpamAssassin to operate on the example port (TCP/10000):

   ~]# semanage port -a -t spamd_port_t -p tcp 10000

   Copy to Clipboard Toggle word wrap
6. Confirm that SpamAssassin will now start and is operating on TCP port 10000:

   ~]# service spamassassin start
   Starting spamd:					[ OK ]
   
   ~]# netstat -lnp | grep 10000
   tcp	0	0 127.0.0.1:10000	0.0.0.0:*	LISTEN	2224/spamd.pid
   

   Copy to Clipboard Toggle word wrap
7. At this point, spamd is properly operating on TCP port 10000 as it has been allowed access to that port by SELinux policy.