[ertugrulkeyvan]

What

I ran the new install.sh on a clean Rocky Linux 9.8 (SELinux enforcing, firewalld on). The install, the wizard and an update from Setup -> Updates to 1.6.0-beta.1 all worked with no SELinux denials. One thing did not: PHP mail, the default selection under Setup -> General -> Mail.

With Postfix installed, the test email failed with Connection to "process /usr/sbin/sendmail -bs -i" has been closed unexpectedly. The audit log showed two denials, one after the other:

1. PHP-FPM (httpd_t) may not run sendmail: httpd_can_sendmail is off by default (denied { read } comm=sendmail name=main.cf).
2. With that boolean on, sendmail runs as system_mail_t, and Laravel's default sendmail -bs makes Postfix start its smtpd, which that domain may not execute (denied { execute } comm=sendmail name=smtpd).

With the boolean on and MAIL_SENDMAIL_PATH="/usr/sbin/sendmail -t -i", the test email reached the mailbox and the audit log stayed empty. Mail sent by the scheduler runs unconfined and was never affected, so only mail sent during a web request failed: the test button, and anything mailed straight from a page.

How

• configure_selinux: also setsebool -P httpd_can_sendmail 1.
• install_app: on the RHEL family, MAIL_SENDMAIL_PATH="/usr/sbin/sendmail -t -i" is written to .env with the other values, through EnvWriter as before. Ubuntu and Debian are unchanged.
• docs/install/native.md step 10: the same two settings for a server set up by hand, and the error that shows without them.

Tests

On the same Rocky 9 server, I cleaned it and installed again with this install.sh: httpd_can_sendmail came out on, .env had the sendmail path, and the test email was delivered with no denial. An empty mail_env array expands to nothing under set -u; checked with bash 3.2 and 5. bash -n install.sh passes. There is no test suite for the shell installer.

[Panelica]

Thank you @ertugrulkeyvan, merged in 5fb5d8d. Tracing both denials one after the other, and checking that the scheduler's mail was never affected, made this easy to follow.

What we checked:

• Laravel reads MAIL_SENDMAIL_PATH for the sendmail mailer, which "PHP mail" uses. Symfony's -t mode still reports a failed sendmail (non-zero exit becomes an exception), and the envelope recipients are passed on the command line, so Bcc works and the header is removed.
• In systemd containers (no SELinux, so the setsebool line itself could not be exercised here): on Rocky Linux 9 the installer finished, .env got MAIL_SENDMAIL_PATH="/usr/sbin/sendmail -t -i", Laravel resolved that path, and a message sent as apache through the sendmail transport was delivered by Postfix with the Bcc header removed. On Debian 12 nothing changed: no MAIL_SENDMAIL_PATH, the default -bs -i, and mail delivered the same way.
• Full suite on the merged branch: 4230 passed, 3 skipped, 0 failed.

This will be part of the next release.