Attachment 604597 Details for Bug 848372 – File: description

File: description

description (text/plain), 1.96 KB, created by Elad Alfassa on 2012-08-15 12:34:59 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Elad Alfassa

Created: 2012-08-15 12:34:59 UTC

Size: 1.96 KB

patch

obsolete

>SELinux is preventing systemd-journal from 'search' accesses on the directory /sys/fs/cgroup.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that systemd-journal should be allowed search access on the cgroup directory by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep systemd-journal /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:syslogd_t:s0
>Target Context                system_u:object_r:cgroup_t:s0
>Target Objects                /sys/fs/cgroup [ dir ]
>Source                        systemd-journal
>Source Path                   systemd-journal
>Port                          <Unknown>
>Host                          (removed)
>Source RPM Packages           
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-6.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Enforcing
>Host Name                     (removed)
>Platform                      Linux (removed) 3.6.0-0.rc1.git6.1.fc18.x86_64 #1
>                              SMP Tue Aug 14 12:13:12 UTC 2012 x86_64 x86_64
>Alert Count                   7
>First Seen                    2012-08-15 10:58:49 IDT
>Last Seen                     2012-08-15 11:01:08 IDT
>Local ID                      788f9dfb-e7c0-46d5-b8dd-2b3173854fa0
>
>Raw Audit Messages
>type=AVC msg=audit(1345017668.296:80): avc:  denied  { search } for  pid=337 comm="systemd-journal" name="/" dev="tmpfs" ino=9255 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=dir
>
>
>Hash: systemd-journal,syslogd_t,cgroup_t,dir,search
>
>audit2allow
>
>#============= syslogd_t ==============
>allow syslogd_t cgroup_t:dir search;
>
>audit2allow -R
>
>#============= syslogd_t ==============
>allow syslogd_t cgroup_t:dir search;
>

Actions: View

Attachments on bug 848372: 604595 | 604596 | 604597