Hello everyone,
I’m running into a strange problem with piwik and SELinux. Every now and then, I see two avc deny errors, which looks like this:
avc: denied { write } for pid=2255 comm="sendmail" path="/home/user/public_html/piwik/tmp/climulti/12383c0b3ddd2e5240ae19c9e1b0eac1677c7462a0aa95b092613fd6e07525b2294854ce89c9b1366cfe861c693d7e8b42cd0.output" dev="sda" ino=404462 scontext=system_u:system_r:system_mail_t:s0 tcontext=system_u:object_r:httpd_sys_rw_content_t:s0 tclass=file
avc: denied { read } for pid=2255 comm="sendmail" path="/home/user/public_html/piwik/misc/GeoLiteCity.dat" dev="sda" ino=269249 scontext=system_u:system_r:system_mail_t:s0 tcontext=unconfined_u:object_r:httpd_sys_rw_content_t:s0 tclass=file
Apparently, piwik is trying to execute sendmail (which is a sym link to sendmail.postfix in CentOS7) to send an email, while at the same time trying to read the Geo IP database.
Anyone knows, if this is some kind of “phone home” that sends emails back to the piwik developers? probably hinting on the geographic location of the server?
Or is it something more troublesome, like a compromised piwik installation?
Any help would be appreciated.
Thank you.
PS:
The above doesn’t appear in the logs very often, so its possible it only happens when I do an upgrade to a new version or something similar, that happens infrequently.