selinux December 2007

selinux@lists.fedoraproject.org

38 participants
66 discussions

SELinux is preventing /usr/sbin/hald (hald_t) "read" to <Unknown> (system_crond_var_lib_t)., and others
by Antonio Olivares 22 Dec '07

22 Dec '07

Dear all, running rawhide: [olivares@localhost ~]$ uname -a Linux localhost 2.6.24-0.115.rc5.git5.fc9 #1 SMP Tue Dec 18 23:57:17 EST 2007 i686 athlon i386 GNU/Linux [olivares@localhost ~]$ cat /etc/fedora-release Fedora release 8.90 (Rawhide) [olivares@localhost ~]$ After a while of booting with enforcing=0, and now setroubleshoot kicks in, it is reporting lots of havoc, notably the following: Summary SELinux is preventing /usr/sbin/hald (hald_t) "read" to <Unknown> (system_crond_var_lib_t). Detailed Description SELinux denied access requested by /usr/sbin/hald. It is not expected that this access is required by /usr/sbin/hald and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for <Unknown>, restorecon -v <Unknown> If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context unconfined_u:system_r:hald_t Target Context system_u:object_r:system_crond_var_lib_t Target Objects None [ file ] Affected RPM Packages hal-0.5.10-3.fc9 [application] Policy RPM selinux-policy-3.2.5-2.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.catchall_file Host Name localhost Platform Linux localhost 2.6.24-0.115.rc5.git5.fc9 #1 SMP Tue Dec 18 23:57:17 EST 2007 i686 athlon Alert Count 2 First Seen Fri 21 Dec 2007 01:49:40 PM CST Last Seen Fri 21 Dec 2007 01:49:53 PM CST Local ID c4301741-d5e1-42f5-9c6d-0008aeef8586 Line Numbers Raw Audit Messages avc: denied { read } for comm=hald dev=dm-0 egid=0 euid=0 exe=/usr/sbin/hald exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name=PolicyKit.reload pid=30320 scontext=unconfined_u:system_r:hald_t:s0 sgid=0 subj=unconfined_u:system_r:hald_t:s0 suid=0 tclass=file tcontext=system_u:object_r:system_crond_var_lib_t:s0 tty=(none) uid=0 It now makes sense that haldeamon does not run because selinux prevents it from doing so: [root@localhost ~]# service haldaemon status hald is stopped [root@localhost ~]# service haldaemon start Starting HAL daemon: [FAILED] [root@localhost ~]# service haldaemon stop Stopping HAL daemon: [FAILED] [root@localhost ~]# service haldaemon restart Stopping HAL daemon: [FAILED] Starting HAL daemon: [FAILED] [root@localhost ~]# K3b tells me the following: * similar to what Antonio M. also previously told us * No CD/DVD writer found. K3b did not find an optical writing device in your system. Thus, you will not be able to burn CDs or DVDs. However, you can still use other K3b features like audio track extraction or audio transcoding or ISO9660 image creation. I am about to go to the holidays, just reporting an observation. Should I file bugs or has this been taken care of ? Thanks to all for reading this far. I also saw this : Summary SELinux prevented dbus-daemon from using the terminal /dev/tty1. Detailed Description SELinux prevented dbus-daemon from using the terminal /dev/tty1. In most cases daemons do not need to interact with the terminal, usually these avc messages can be ignored. All of the confined daemons should have dontaudit rules around using the terminal. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this selinux- policy. If you would like to allow all daemons to interact with the terminal, you can turn on the allow_daemons_use_tty boolean. Allowing Access Changing the "allow_daemons_use_tty" boolean to true will allow this access: "setsebool -P allow_daemons_use_tty=1." The following command will allow this access: setsebool -P allow_daemons_use_tty=1 Additional Information Source Context unconfined_u:unconfined_r:unconfined_dbusd_t :SystemLow-SystemHigh Target Context unconfined_u:object_r:unconfined_tty_device_t Target Objects /dev/tty1 [ chr_file ] Affected RPM Packages Policy RPM selinux-policy-3.2.5-2.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.allow_daemons_use_tty Host Name localhost Platform Linux localhost 2.6.24-0.115.rc5.git5.fc9 #1 SMP Tue Dec 18 23:57:17 EST 2007 i686 athlon Alert Count 7 First Seen Wed 19 Dec 2007 07:36:11 PM CST Last Seen Fri 21 Dec 2007 01:29:01 PM CST Local ID 66ca0ade-760e-4112-9557-5c46b66b1296 Line Numbers Raw Audit Messages avc: denied { read write } for comm=dbus-daemon dev=tmpfs path=/dev/tty1 pid=28235 scontext=unconfined_u:unconfined_r:unconfined_dbusd_t:s0-s0:c0.c1023 tclass=chr_file tcontext=unconfined_u:object_r:unconfined_tty_device_t:s0 and this one Summary SELinux is preventing access to files with the label, file_t. Detailed Description SELinux permission checks on files labeled file_t are being denied. file_t is the context the SELinux kernel gives to files that do not have a label. This indicates a serious labeling problem. No files on an SELinux box should ever be labeled file_t. If you have just added a new disk drive to the system you can relabel it using the restorecon command. Otherwise you should relabel the entire files system. Allowing Access You can execute the following command as root to relabel your computer system: "touch /.autorelabel; reboot" Additional Information Source Context system_u:system_r:tmpreaper_t Target Context system_u:object_r:file_t Target Objects /tmp/virtual-olivares.1dNZIJ [ dir ] Affected RPM Packages Policy RPM selinux-policy-3.2.5-2.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.file Host Name localhost Platform Linux localhost 2.6.24-0.115.rc5.git5.fc9 #1 SMP Tue Dec 18 23:57:17 EST 2007 i686 athlon Alert Count 1 First Seen Fri 21 Dec 2007 10:36:45 AM CST Last Seen Fri 21 Dec 2007 10:36:45 AM CST Local ID 59f19014-265b-4a97-96ff-b86653d2fe1d Line Numbers Raw Audit Messages avc: denied { getattr } for comm=tmpwatch dev=dm-0 path=/tmp/virtual- olivares.1dNZIJ pid=14502 scontext=system_u:system_r:tmpreaper_t:s0 tclass=dir tcontext=system_u:object_r:file_t:s0 Happy Holidays -> Merry Christmas and a Happy New Year ! Regards, Antonio ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

2 1

RE: GDM problems: gdm-binary
by Dan Thurman 21 Dec '07

21 Dec '07

Paul Howarth wrote: >"Daniel B. Thurman" <dant(a)cdkkt.com> wrote: > >> Paul Howarth wrote: >> >Daniel B. Thurman wrote: >> >> Daniel B. Thurman wrote: >> >>> Due to reasons of my /usr space partition running out of >> >>> room, I had tar-copied my /usr/share directory into different >> >>> partition, deleted the contents of /usr/share, changed the >> >>> fstab to mount the /share partition /usr/share. Because there >> >>> is a filesystem change, I believed an autorelabel is necessary >> >>> to ensure that all of the selinux tags are properly labeled. >> > >> >... >> > >> >> I found some more problems with selinux tags and somehow it >> >> is not able to label files after a autorelabel which I was >> >> hoping it would fix but does not. Can someone please tell >> >> me how to fix these problems? >> >> >> >>>From /var/log/audit log: >> >> ============================================================>> >> >> type=SYSCALL msg=audit(1198252520.322:187): arch@000003 >> >syscall2 success=no exit=-13 a0=3 a1¿c093c0 a2·f6d31c >> >a3=0 items=0 ppid'00 pid667 auidB94967295 uid=0 gid=0 >> >euid=0 suid=0 fsuid=0 egidQ sgidQ fsgidQ tty=(none) >> >comm="sendmail" exe="/usr/sbin/sendmail.sendmail" >> >subj=system_u:system_r:sendmail_t:s0 key=(null) >> >> type=AVC msg=audit(1198252520.322:187): avc: denied { >> >connectto } for pid667 comm="sendmail" >> >path="/var/run/spamass-milter/spamass-milter.sock" >> >scontext=system_u:system_r:sendmail_t:s0 >> >tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket >> >> type=AVC msg=audit(1198252486.805:186): avc: denied { >> >connectto } for pid647 comm="sendmail" >> >path="/var/run/spamass-milter/spamass-milter.sock" >> >scontext=system_u:system_r:sendmail_t:s0 >> >tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket >> > >> >This looks remarkably like this bug report: >> >https://bugzilla.redhat.com/show_bug.cgi?idB5958 >> > >> >You seem to have the socket labelled as initrc_t rather than >> >spamd_var_run_t, but I don't know why this should happen. >> > >> >Can you post the output of: >> >$ ls -lZd /var/run >> >> drwxr-xr-x root root system_u:object_r:var_run_t:s0 /var/run >> >> >$ ls -laZ /var/run/spamass-milter >> >> drwxr-x--- sa-milt root system_u:object_r:spamd_var_run_t:s0 . >> drwxr-xr-x root root system_u:object_r:var_run_t:s0 .. >> srwxr-xr-x sa-milt sa-milt system_u:object_r:spamd_var_run_t:s0 >> spamass-milter.sock > >This all looks normal so I guess you're not getting the AVCs from >spamass-milter anymore? > >> >>From /var/log/messages log: (Note that all of these errors are >> >> coming from the /usr/share that is mounted from a drive partition >> >> while all in / is in its own partition, but /usr/share) >> >> ============================================================>> Dec >> >> 21 07:50:21 linux kernel: audit(1198252191.457:5): avc: >> >denied { search } for pid69 comm="rhgb" name="share" >> >dev=sda2 ino2929 scontext=system_u:system_r:rhgb_t:s0 >> >tcontext=user_u:object_r:default_t:s0 tclass=dir >> > >> >Try unmounting /usr/share, labelling the now-empty directory as >> >mnt_t, >> >> How do I do this, please? > ># umount /usr/share ># chcon -t mnt_t /usr/share > >> >remounting /usr/share and labelling the mounted directory as usr_t. > ># mount /usr/share ># chcon -t usr_t /usr/share > >Paul. Notes: 1: Just to make sure that I have noted it here, the latest yum updates have been applied. 2: The mounting of LABEL=/share to /usr/share appears as a drive on the desktop, unlike /usr, which does not appear. This is quite annoying. Why is that it appears on the desktop? 1. Have have done what you have asked, above. 2. restorecon -vvR /usr <no corrections were made> 3. clamav-milter: + was never started at boot. Logs show a permission problem with clamav.log + deleted: /var/log/clamav-milter/clamav.log + service clamav-milter start <no more sealert permissions problems, it started up!> [perhaps, the problem here is that an existing log file from a previous startup, is no longer accepted and fails on the next reboot unless clamav-milter service is shutdown, the log file is deleted, before rebooting. This has been verified.] 4. spamass-milter: + The spamass-milter.sock orignally when created at reboot shows: srwxr-xr-x sa-milt sa-milt system_u:object_r:spamd_var_run_t:s0 spamass-milter.sock BUT, when restarting spamassassin, it shows a different user context: drwxr-x--- sa-milt root system_u:object_r:spamd_var_run_t:s0 . drwxr-xr-x root root system_u:object_r:var_run_t:s0 .. srwxr-xr-x sa-milt sa-milt unconfined_u:object_r:spamd_var_run_t:s0 spamass-milter.sock ----------------------------^^^^^^^^^^^^ + chcon -u system_u spamass-milter.sock <has no effect, sealert continues> + chcon -t initrc_t spamass-milter.sock <permission denied, even as root user> 5. I still have unresolved issues with the others: rhgb, xorg, ifconfig, xdm-server Any ideas, anyone? No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.6/1192 - Release Date: 12/21/2007 1:17 PM

1 0

RE: GDM problems: gdm-binary
by Dan Thurman 21 Dec '07

21 Dec '07

Paul Howarth wrote: >"Daniel B. Thurman" <dant(a)cdkkt.com> wrote: >> Paul Howarth wrote: > >This all looks normal so I guess you're not getting the AVCs from >spamass-milter anymore? Rats, I forgot to add that I still get the sealert errors reporting type initrc_t, even though the actual type on the file is spamd_var_run_t Please read the previous post for my detailed report other than the above I forgot to include. Sorry about that! Dan No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.6/1192 - Release Date: 12/21/2007 1:17 PM

1 0

RE: GDM problems: gdm-binary
by Dan Thurman 21 Dec '07

21 Dec '07

Paul Howarth wrote: >Daniel B. Thurman wrote: >> Daniel B. Thurman wrote: >>> Due to reasons of my /usr space partition running out of >>> room, I had tar-copied my /usr/share directory into different >>> partition, deleted the contents of /usr/share, changed the >>> fstab to mount the /share partition /usr/share. Because there >>> is a filesystem change, I believed an autorelabel is necessary >>> to ensure that all of the selinux tags are properly labeled. > >... > >> I found some more problems with selinux tags and somehow it >> is not able to label files after a autorelabel which I was >> hoping it would fix but does not. Can someone please tell >> me how to fix these problems? >> >>>From /var/log/audit log: >> ============================================================= >> type=SYSCALL msg=audit(1198252520.322:187): arch=40000003 >syscall=102 success=no exit=-13 a0=3 a1=bfc093c0 a2=b7f6d31c >a3=0 items=0 ppid=2700 pid=3667 auid=4294967295 uid=0 gid=0 >euid=0 suid=0 fsuid=0 egid=51 sgid=51 fsgid=51 tty=(none) >comm="sendmail" exe="/usr/sbin/sendmail.sendmail" >subj=system_u:system_r:sendmail_t:s0 key=(null) >> type=AVC msg=audit(1198252520.322:187): avc: denied { >connectto } for pid=3667 comm="sendmail" >path="/var/run/spamass-milter/spamass-milter.sock" >scontext=system_u:system_r:sendmail_t:s0 >tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket >> type=AVC msg=audit(1198252486.805:186): avc: denied { >connectto } for pid=3647 comm="sendmail" >path="/var/run/spamass-milter/spamass-milter.sock" >scontext=system_u:system_r:sendmail_t:s0 >tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket > >This looks remarkably like this bug report: >https://bugzilla.redhat.com/show_bug.cgi?id=425958 > >You seem to have the socket labelled as initrc_t rather than >spamd_var_run_t, but I don't know why this should happen. > >Can you post the output of: >$ ls -lZd /var/run drwxr-xr-x root root system_u:object_r:var_run_t:s0 /var/run >$ ls -laZ /var/run/spamass-milter drwxr-x--- sa-milt root system_u:object_r:spamd_var_run_t:s0 . drwxr-xr-x root root system_u:object_r:var_run_t:s0 .. srwxr-xr-x sa-milt sa-milt system_u:object_r:spamd_var_run_t:s0 spamass-milter.sock >$ sestatus -v SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 21 Policy from config file: targeted Process contexts: Current context: unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 Init context: system_u:system_r:init_t:s0 /sbin/mingetty system_u:system_r:getty_t:s0 /usr/sbin/sshd system_u:system_r:sshd_t:s0-s0:c0.c1023 File contexts: Controlling term: unconfined_u:object_r:unconfined_devpts_t:s0 /etc/passwd system_u:object_r:etc_t:s0 /etc/shadow system_u:object_r:shadow_t:s0 /bin/bash system_u:object_r:shell_exec_t:s0 /bin/login system_u:object_r:login_exec_t:s0 /bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0 /sbin/agetty system_u:object_r:getty_exec_t:s0 /sbin/init system_u:object_r:init_exec_t:s0 /sbin/mingetty system_u:object_r:getty_exec_t:s0 /usr/sbin/sshd system_u:object_r:sshd_exec_t:s0 /lib/libc.so.6 system_u:object_r:lib_t:s0 -> system_u:object_r:lib_t:s0 /lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0 > >>From /var/log/messages log: (Note that all of these errors are >> coming from the /usr/share that is mounted from a drive partition >> while all in / is in its own partition, but /usr/share) >> ============================================================= >> Dec 21 07:50:21 linux kernel: audit(1198252191.457:5): avc: >denied { search } for pid=1169 comm="rhgb" name="share" >dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 >tcontext=user_u:object_r:default_t:s0 tclass=dir > >Try unmounting /usr/share, labelling the now-empty directory as mnt_t, How do I do this, please? >remounting /usr/share and labelling the mounted directory as usr_t. > >Paul. No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.6/1192 - Release Date: 12/21/2007 1:17 PM

2 1

RE: GDM problems: gdm-binary
by Dan Thurman 21 Dec '07

21 Dec '07

Daniel B. Thurman wrote: > >Due to reasons of my /usr space partition running out of >room, I had tar-copied my /usr/share directory into different >partition, deleted the contents of /usr/share, changed the >fstab to mount the /share partition /usr/share. Because there >is a filesystem change, I believed an autorelabel is necessary >to ensure that all of the selinux tags are properly labeled. > >Fortunately, after a reboot, I was able to log into my system, >but not without some problems. The following is a list of issues >that cropped up during the ordeal: > >When I rebooted after changing /usr/share: > >1. The normal linux textscreen data appears >2. udev >3. A black screen with quick X11 black/white "watch" cursor popped up > then it disappeared quickly, like a flash. > [NOTE: > Here, you would normally see a gnome cursor with a blue spinner > then a gui screen showing the progress bar on the >loading of services > ] >4. Then it switched back into text mode showing (among other things), > the last 4 lines: > a. Remounting / rw > b. Mounting local filesystems > c. Doing local filesystem quotas > d. Enabling /etc/fstab swap > [text-cursor sits waiting] and less than a minute later, > (Maybe services are being loaded during this waiting period > but you cannot know or see it, can only assume it is or after > logging in. Turns out that services are loaded successfully. > It is interesting to note that loading of services are VERY > QUICK compared to watching the gui screen on service loading > progress. Interesting.) >5. The gui login screen pops up. >6. I am able to log in as myself as a normal user. >7. Many sealert messages popped up, most of it showing GDM, sendmail, > clamav, spamassassin avc denial errors. >8. After hours trying restorecon in progression: > a. /var/run/{clamav-milter,clamd.clamdsvc} directory > i. restorecon -vR on these directries did not work, >sealerts kept coming > ii. Changed directory permissions to 750, owners to [owner]:root > Problem solved. sealert stopped. > b. SpamAssassin > i. After many attempts to fix this, I finally tried: > rm -fr ~[users]/.spamassasin directories > Problem solved. selalerts stopped for spamassassin. > [NOTE: ~[user]/.spamassassin is automatically recreated.] >9. Now, tying to solve gdm-binary problems: > a. Remove and reinstall GDM. > It fixed a /var/log/messages error entry that showed >gdm-binary was > segfaulting, but it did not restore the missing >services-loading gui > screen and there are still problems with gdm-binary and sealerts. > > b. Grepping for GDM in the /var/log/messages file reveals: > > + Dec 19 07:42:59 linux setroubleshoot: #012 SELinux is >preventing gdm-binary (xdm_t) "signal" to <Unknown> >(mono_t).#012 For complete SELinux messages. run sealert >-l 966ed3a0-cb89-41cc-8eff-7168d263b538 > + Dec 19 07:47:17 linux gdm-binary[2998]: (null): cannot >open shared object file: No such file or directory > > Running: sealert -l 966ed3a0-cb89-41cc-8eff-7168d263b538 > ======================================================== > Summary > SELinux is preventing gdm-binary (xdm_t) "signal" to ><Unknown> (mono_t). > > Detailed Description > SELinux denied access requested by gdm-binary. It is >not expected that this > access is required by gdm-binary and this access may >signal an intrusion > attempt. It is also possible that the specific >version or configuration of > the application is causing it to require additional access. > > Allowing Access > You can generate a local policy module to allow this >access - see > >http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or >you can disable > SELinux protection altogether. Disabling SELinux >protection is not > recommended. Please file a >http://bugzilla.redhat.com/bugzilla/enter_bug.cgi > against this package. > > Additional Information > > Source Context >system_u:system_r:xdm_t:s0-s0:c0.c1023 > Target Context >system_u:system_r:mono_t:s0-s0:c0.c1023 > Target Objects None [ process ] > Affected RPM Packages > Policy RPM selinux-policy-3.0.8-64.fc8 > Selinux Enabled True > Policy Type targeted > MLS Enabled True > Enforcing Mode Enforcing > Plugin Name plugins.catchall > Host Name linux.cdkkt.com > Platform Linux linux.cdkkt.com >2.6.23.8-63.fc8 #1 SMP Wed > Nov 21 18:51:08 EST 2007 i686 i686 > Alert Count 2 > First Seen Wed Dec 19 07:42:32 2007 > Last Seen Wed Dec 19 07:42:48 2007 > Local ID >966ed3a0-cb89-41cc-8eff-7168d263b538 > Line Numbers > > Raw Audit Messages > > avc: denied { signal } for comm=gdm-binary pid=3060 > scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process > tcontext=system_u:system_r:mono_t:s0-s0:c0.c1023 > ====================================================== > > c. I am thinking of removing and reinstalling mono since it seems > that mono problems are showing in the above sealert trace? > >Note: > 1. Tar (with --xattrs) and cp -a does not preserve the selinux tags > at all. It seems broken. It is possible, but not >verified, that > maybe the copy-over of some files got corrupted? > 2. It seems that autorelabeling does not completely >relabel and restore > selinux tags faithfully? > > I have reinstalled gdm, rhgb, clamav-milter, spamass-milter and I am not able to fix the problems I am trying to solve. I found some more problems with selinux tags and somehow it is not able to label files after a autorelabel which I was hoping it would fix but does not. Can someone please tell me how to fix these problems? >From /var/log/audit log: ============================================================= type=SYSCALL msg=audit(1198252520.322:187): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfc093c0 a2=b7f6d31c a3=0 items=0 ppid=2700 pid=3667 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=51 sgid=51 fsgid=51 tty=(none) comm="sendmail" exe="/usr/sbin/sendmail.sendmail" subj=system_u:system_r:sendmail_t:s0 key=(null) type=AVC msg=audit(1198252520.322:187): avc: denied { connectto } for pid=3667 comm="sendmail" path="/var/run/spamass-milter/spamass-milter.sock" scontext=system_u:system_r:sendmail_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1198252486.805:186): avc: denied { connectto } for pid=3647 comm="sendmail" path="/var/run/spamass-milter/spamass-milter.sock" scontext=system_u:system_r:sendmail_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket >From /var/log/messages log: (Note that all of these errors are coming from the /usr/share that is mounted from a drive partition while all in / is in its own partition, but /usr/share) ============================================================= Dec 21 07:50:21 linux kernel: audit(1198252191.457:5): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.457:6): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.457:7): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.457:8): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.457:9): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.457:10): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.457:11): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.547:12): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.547:13): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.547:14): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.547:15): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.547:16): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.548:17): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.548:18): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.548:19): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.548:20): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.687:21): avc: denied { search } for pid=1170 comm="ifconfig" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:ifconfig_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.687:22): avc: denied { search } for pid=1170 comm="ifconfig" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:ifconfig_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.687:23): avc: denied { search } for pid=1170 comm="ifconfig" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:ifconfig_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.688:24): avc: denied { search } for pid=1170 comm="ifconfig" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:ifconfig_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.688:25): avc: denied { search } for pid=1170 comm="ifconfig" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:ifconfig_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.688:26): avc: denied { search } for pid=1170 comm="ifconfig" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:ifconfig_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252191.688:27): avc: denied { search } for pid=1170 comm="ifconfig" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:ifconfig_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.653:28): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.931:29): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.939:30): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.939:31): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.939:32): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.939:33): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.959:34): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.959:35): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.959:36): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.959:37): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.959:38): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.959:39): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.959:40): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.959:41): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.960:42): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.960:43): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.961:44): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.961:45): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.961:46): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.961:47): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.961:48): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.962:49): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.962:50): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.962:51): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.962:52): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.962:53): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.962:54): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.964:55): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.964:56): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.990:57): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.990:58): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.990:59): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.990:60): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.990:61): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252193.990:62): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.175:63): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.175:64): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.175:65): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.175:66): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.354:67): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.374:68): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.374:69): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.374:70): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.374:71): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.407:72): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.408:73): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.408:74): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.408:75): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.408:76): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.408:77): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.408:78): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.468:79): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.468:80): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.468:81): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.468:82): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.468:83): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.468:84): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.494:85): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.494:86): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.494:87): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.494:88): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.494:89): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.494:90): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.494:91): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.570:92): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.570:93): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.570:94): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.570:95): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.571:96): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.571:97): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.571:98): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.571:99): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.603:100): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.603:101): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.603:102): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.603:103): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.847:104): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.847:105): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.847:106): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.847:107): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.847:108): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.847:109): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.854:110): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252194.854:111): avc: denied { search } for pid=1169 comm="rhgb" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:rhgb_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.094:112): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.350:113): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.350:114): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.351:115): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.351:116): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.351:117): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.351:118): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.351:119): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.351:120): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.351:121): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.351:122): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.351:123): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.351:124): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.352:125): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.352:126): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.352:127): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.352:128): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.352:129): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.352:130): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.352:131): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.352:132): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.352:133): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.352:134): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.353:135): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.353:136): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.353:137): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.353:138): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.353:139): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:50:21 linux kernel: audit(1198252195.353:140): avc: denied { search } for pid=1179 comm="Xorg" name="share" dev=sda2 ino=102929 scontext=system_u:system_r:xdm_xserver_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=dir Dec 21 07:51:05 linux setroubleshoot: #012 SELinux is preventing /usr/sbin/clamav-milter (clamd_t) "append" to <Unknown> (var_log_t).#012 For complete SELinux messages. run sealert -l 3339843a-b196-4c68-8241-0b8722c2ec40 Dec 21 07:53:11 linux setroubleshoot: #012 SELinux is preventing sendmail (sendmail_t) "connectto" to /var/run/spamass-milter/spamass-milter.sock (initrc_t).#012 For complete SELinux messages. run sealert -l 70f55a23-8d63-4ffe-9d17-1cd63ac4123f No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.6/1192 - Release Date: 12/21/2007 1:17 PM

2 1

SELINUX_ERR during update of libgnome
by Tom London 20 Dec '07

20 Dec '07

Running selinux-policy-3.2.4-5.fc9, targeted/enforcing. yum updating libgnome produced: Updating : libgnome ##################### [ 23/198] /var/tmp/rpm-tmp.65437: line 1: /usr/sbin/groupadd: Permission denied The following is in /var/log/audit/audit.log: type=SELINUX_ERR msg=audit(1198114407.394:63): security_compute_sid: invalid context unconfined_u:unconfined_r:groupadd_t:s0 for scontext=unconfined_u:unconfined_r:rpm_script_t:s0 tcontext=system_u:object_r:groupadd_exec_t:s0 tclass=process type=SYSCALL msg=audit(1198114407.394:63): arch=40000003 syscall=11 success=no exit=-13 a0=92e3d38 a1=92e3058 a2=92e2bc8 a3=0 items=0 ppid=26907 pid=26908 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="sh" exe="/bin/bash" subj=unconfined_u:unconfined_r:rpm_script_t:s0 key=(null) type=SELINUX_ERR msg=audit(1198114429.545:64): security_compute_sid: invalid context unconfined_u:unconfined_r:useradd_t:s0 for scontext=unconfined_u:unconfined_r:rpm_script_t:s0 tcontext=system_u:object_r:useradd_exec_t:s0 tclass=process type=SYSCALL msg=audit(1198114429.545:64): arch=40000003 syscall=11 success=no exit=-13 a0=96c8208 a1=96c7ad0 a2=96c6bc8 a3=0 items=0 ppid=26946 pid=26947 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="sh" exe="/bin/bash" subj=unconfined_u:unconfined_r:rpm_script_t:s0 key=(null) tom -- Tom London

3 4

GDM problems: gdm-binary
by Dan Thurman 20 Dec '07

20 Dec '07

Due to reasons of my /usr space partition running out of room, I had tar-copied my /usr/share directory into different partition, deleted the contents of /usr/share, changed the fstab to mount the /share partition /usr/share. Because there is a filesystem change, I believed an autorelabel is necessary to ensure that all of the selinux tags are properly labeled. Fortunately, after a reboot, I was able to log into my system, but not without some problems. The following is a list of issues that cropped up during the ordeal: When I rebooted after changing /usr/share: 1. The normal linux textscreen data appears 2. udev 3. A black screen with quick X11 black/white "watch" cursor popped up then it disappeared quickly, like a flash. [NOTE: Here, you would normally see a gnome cursor with a blue spinner then a gui screen showing the progress bar on the loading of services ] 4. Then it switched back into text mode showing (among other things), the last 4 lines: a. Remounting / rw b. Mounting local filesystems c. Doing local filesystem quotas d. Enabling /etc/fstab swap [text-cursor sits waiting] and less than a minute later, (Maybe services are being loaded during this waiting period but you cannot know or see it, can only assume it is or after logging in. Turns out that services are loaded successfully. It is interesting to note that loading of services are VERY QUICK compared to watching the gui screen on service loading progress. Interesting.) 5. The gui login screen pops up. 6. I am able to log in as myself as a normal user. 7. Many sealert messages popped up, most of it showing GDM, sendmail, clamav, spamassassin avc denial errors. 8. After hours trying restorecon in progression: a. /var/run/{clamav-milter,clamd.clamdsvc} directory i. restorecon -vR on these directries did not work, sealerts kept coming ii. Changed directory permissions to 750, owners to [owner]:root Problem solved. sealert stopped. b. SpamAssassin i. After many attempts to fix this, I finally tried: rm -fr ~[users]/.spamassasin directories Problem solved. selalerts stopped for spamassassin. [NOTE: ~[user]/.spamassassin is automatically recreated.] 9. Now, tying to solve gdm-binary problems: a. Remove and reinstall GDM. It fixed a /var/log/messages error entry that showed gdm-binary was segfaulting, but it did not restore the missing services-loading gui screen and there are still problems with gdm-binary and sealerts. b. Grepping for GDM in the /var/log/messages file reveals: + Dec 19 07:42:59 linux setroubleshoot: #012 SELinux is preventing gdm-binary (xdm_t) "signal" to <Unknown> (mono_t).#012 For complete SELinux messages. run sealert -l 966ed3a0-cb89-41cc-8eff-7168d263b538 + Dec 19 07:47:17 linux gdm-binary[2998]: (null): cannot open shared object file: No such file or directory Running: sealert -l 966ed3a0-cb89-41cc-8eff-7168d263b538 ======================================================== Summary SELinux is preventing gdm-binary (xdm_t) "signal" to <Unknown> (mono_t). Detailed Description SELinux denied access requested by gdm-binary. It is not expected that this access is required by gdm-binary and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access You can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:system_r:mono_t:s0-s0:c0.c1023 Target Objects None [ process ] Affected RPM Packages Policy RPM selinux-policy-3.0.8-64.fc8 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.catchall Host Name linux.cdkkt.com Platform Linux linux.cdkkt.com 2.6.23.8-63.fc8 #1 SMP Wed Nov 21 18:51:08 EST 2007 i686 i686 Alert Count 2 First Seen Wed Dec 19 07:42:32 2007 Last Seen Wed Dec 19 07:42:48 2007 Local ID 966ed3a0-cb89-41cc-8eff-7168d263b538 Line Numbers Raw Audit Messages avc: denied { signal } for comm=gdm-binary pid=3060 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=process tcontext=system_u:system_r:mono_t:s0-s0:c0.c1023 ====================================================== c. I am thinking of removing and reinstalling mono since it seems that mono problems are showing in the above sealert trace? Note: 1. Tar (with --xattrs) and cp -a does not preserve the selinux tags at all. It seems broken. It is possible, but not verified, that maybe the copy-over of some files got corrupted? 2. It seems that autorelabeling does not completely relabel and restore selinux tags faithfully? No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.503 / Virus Database: 269.17.5/1190 - Release Date: 12/19/2007 7:37 PM

1 0

sound problems, login works from level 3 no gdm
by Antonio Olivares 19 Dec '07

19 Dec '07

Dear all, Upon booting to newer released kernel [olivares@localhost ~]$ uname -iprm 2.6.24-0.115.rc5.git5.fc9 i686 athlon i386 Sound does not work, I tried to use alsamixer, as of a few updates ago, sound came back :), now it went backwards :(. I typed [olivares@localhost ~]$ alsamixer alsamixer: function snd_ctl_open failed for default: No such device [olivares@localhost ~]$ I then used dmesg and from there I saw the following: audit(1198114515.338:4): avc: denied { search } for pid=1134 comm="salsa" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.339:5): avc: denied { search } for pid=1134 comm="salsa" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.340:6): avc: denied { search } for pid=1131 comm="salsa" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.340:7): avc: denied { search } for pid=1131 comm="salsa" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.341:8): avc: denied { search } for pid=1129 comm="salsa" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.341:9): avc: denied { search } for pid=1129 comm="salsa" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.342:10): avc: denied { search } for pid=1136 comm="salsa" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.342:11): avc: denied { search } for pid=1136 comm="salsa" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.343:12): avc: denied { search } for pid=1140 comm="salsa" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.343:13): avc: denied { search } for pid=1140 comm="salsa" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.394:14): avc: denied { search } for pid=1129 comm="alsactl" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.394:15): avc: denied { search } for pid=1129 comm="alsactl" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.403:16): avc: denied { search } for pid=1131 comm="alsactl" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.403:17): avc: denied { search } for pid=1131 comm="alsactl" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.405:18): avc: denied { search } for pid=1134 comm="alsactl" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.405:19): avc: denied { search } for pid=1134 comm="alsactl" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.411:20): avc: denied { search } for pid=1136 comm="alsactl" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.411:21): avc: denied { search } for pid=1136 comm="alsactl" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.424:22): avc: denied { search } for pid=1140 comm="alsactl" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir audit(1198114515.424:23): avc: denied { search } for pid=1140 comm="alsactl" name="nscd" dev=dm-0 ino=3309695 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir EXT3 FS on dm-0, internal journal audit(1198114517.322:24): avc: denied { read } for pid=1177 comm="mount" name="/" dev=usbfs ino=261 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:usbfs_t:s0 tclass=dir audit(1198114517.322:25): avc: denied { read } for pid=1177 comm="mount" name="/" dev=usbfs ino=261 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:usbfs_t:s0 tclass=dir [olivares@localhost ~]$ rpm -qa selinux-* selinux-policy-3.2.4-5.fc9 selinux-policy-targeted-3.2.4-5.fc9 selinux-policy-devel-3.2.4-5.fc9 [olivares@localhost ~]$ GDM still does not work, INIT: error message, but at least login works from level 3 without enforcing=0 starting parameter. Thanks, Antonio ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

F7: update of selinux policy to 61 breaks cups printing
by Mike Carney 19 Dec '07

19 Dec '07

type=AVC msg=audit(1197649819.259:300): avc: denied { getattr } for pid=22338 comm="sh" path="/usr/bin/hpijs" dev=sda2 ino=225020 scontext=user_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:hplip_exec_t:s0 tclass=file type=SYSCALL msg=audit(1197649819.259:300): arch=40000003 syscall=195 success=no exit=-13 a0=9b4bd48 a1=bfbd9f90 a2=9b3ff4 a3=9b4bd48 items=0 ppid=22335 pid=22338 auid=4868 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) comm="sh" exe="/bin/bash" subj=user_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null) Is there an updated version coming?

3 2

dbus AVCS from rhythmbox?
by Tom London 19 Dec '07

19 Dec '07

I have rhythmbox started up in my gnome session. I notice these in /var/log/messages when running in permissive mode: Dec 19 06:16:31 localhost dbus: avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus member=Hello dest=org.freedesktop.DBus spid=2861 scontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_dbusd_t:s0 tclass=dbus Dec 19 06:16:31 localhost dbus: avc: denied { acquire_svc } for service=org.gnome.Rhythmbox spid=2861 scontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_dbusd_t:s0 tclass=dbus or #============= unconfined_execmem_t ============== allow unconfined_execmem_t unconfined_dbusd_t:dbus { acquire_svc send_msg }; That an artifact of running in permissive mode? Or needed? tom -- Tom London

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux December 2007