Attachment 638749 Details for Bug 873381 – alert from SELinux

alert from SELinux

alert.txt (text/plain), 2.45 KB, created by Antonio T. (sagitter) on 2012-11-05 17:14:15 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Antonio T. (sagitter)

Created: 2012-11-05 17:14:15 UTC

Size: 2.45 KB

patch

obsolete

>SELinux is preventing /usr/lib/systemd/systemd-timedated from ioctl access on the chr_file /dev/rtc0.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that systemd-timedated should be allowed ioctl access on the rtc0 chr_file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep systemd-timedat /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:gnomeclock_t:s0
>Target Context                system_u:object_r:clock_device_t:s0
>Target Objects                /dev/rtc0 [ chr_file ]
>Source                        systemd-timedat
>Source Path                   /usr/lib/systemd/systemd-timedated
>Port                          <Unknown>
>Host                          sagitter
>Source RPM Packages           systemd-195-2.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-43.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     sagitter
>Platform                      Linux sagitter 3.6.2-2.fc18.x86_64 #1 SMP Wed Oct
>                              17 05:56:07 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2012-11-05 18:05:00 CET
>Last Seen                     2012-11-05 18:05:00 CET
>Local ID                      a771de03-7ff3-41f7-8213-db59aaca4c5a
>
>Raw Audit Messages
>type=AVC msg=audit(1352135100.0:370): avc:  denied  { ioctl } for  pid=19088 comm="systemd-timedat" path="/dev/rtc0" dev="devtmpfs" ino=7445 scontext=system_u:system_r:gnomeclock_t:s0 tcontext=system_u:object_r:clock_device_t:s0 tclass=chr_file
>
>
>type=SYSCALL msg=audit(1352135100.0:370): arch=x86_64 syscall=ioctl success=yes exit=0 a0=5 a1=4024700a a2=7fc34ac76f40 a3=ffffffffffffc414 items=0 ppid=1 pid=19088 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=systemd-timedat exe=/usr/lib/systemd/systemd-timedated subj=system_u:system_r:gnomeclock_t:s0 key=(null)
>
>Hash: systemd-timedat,gnomeclock_t,clock_device_t,chr_file,ioctl
>
>audit2allow
>
>#============= gnomeclock_t ==============
>allow gnomeclock_t clock_device_t:chr_file ioctl;
>
>audit2allow -R
>
>#============= gnomeclock_t ==============
>allow gnomeclock_t clock_device_t:chr_file ioctl;
>
>

Actions: View

Attachments on bug 873381: 638749