Postfix service fails to start on Linux Server with DCS Prevention enabled

Products

• Data Center Security Server Advanced

Issue/Introduction

Postfix service fails to start on RHEL-based distributions when DCS Prevention Policy is in active prevention mode. The service starts successfully when DCS is disabled.

The following error is observed in the OS logs or when running postfix start

/usr/sbin/postsuper: error while loading shared libraries: libldap-2.4.so.2: cannot open shared object file: Permission denied postfix/postfix-script: fatal: Postfix integrity check failed!

Environment

Operating System: Rocky Linux \ RHEL

DCS Agent Version: 6.10.x

DCS Policy: UNIX Prevention Policy

Cause

The DCS Prevention Policy contains a rule named "Suspicious proxy execution by Mail programs". 

When Postfix attempts to start, the postfix-script executes postsuper.

DCS identifies this execution as a potential "proxy execution" and assigns the postsuper process to the int_nopriv_ps (Internal No Privileges) sandbox.

This restricted sandbox does not have permission to read the required shared libraries, causing the process to fail and preventing Postfix from completing its integrity check.

Resolution

• Edit the prevention policy and navigate to Sandboxes -> Mail [mail_ps] -> Protection Categories -> Sandbox Execution Options -> Exceptions to allow proxy execution
• Add an exception for /usr/sbin/postsuper - see screenshot below
• In some instances, adding /usr/bin/cmp may also be required
• Save the Policy, apply the update Security group and verify if Postfix starts successfully