Attachment 685017 Details for Bug 896624 – Output from sealert -a audit.log > audit.log.sealert.version2.txt

Output from sealert -a audit.log > audit.log.sealert.version2.txt

audit.log.sealert.version2.txt (text/plain), 83.72 KB, created by Roman Rakus on 2013-01-22 10:21:56 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Roman Rakus

Created: 2013-01-22 10:21:56 UTC

Size: 83.72 KB

patch

obsolete

>found 31 alerts in audit.log
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/bin/bash from read access on the file meminfo.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that bash should be allowed read access on the meminfo file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cmpiLMI_Account /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:proc_t:s0
>Target Objects                meminfo [ file ]
>Source                        cmpiLMI_Account
>Source Path                   /usr/bin/bash
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           bash-4.2.42-1.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      5c9c929e-9e0a-4e77-8b2b-567fa0bde4e9
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.82:5930): avc:  denied  { read } for  pid=4422 comm="cmpiLMI_Account" name="meminfo" dev="proc" ino=4026532026 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file
>
>
>type=AVC msg=audit(1358843929.82:5930): avc:  denied  { open } for  pid=4422 comm="cmpiLMI_Account" path="/proc/meminfo" dev="proc" ino=4026532026 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843929.82:5930): arch=x86_64 syscall=open success=yes exit=ESRCH a0=392ab7823b a1=80000 a2=1b6 a3=238 items=0 ppid=4421 pid=4422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cmpiLMI_Account exe=/usr/bin/bash subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cmpiLMI_Account,pegasus_openlmi_account_t,proc_t,file,read
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t proc_t:file { read open };
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t proc_t:file { read open };
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/bin/bash from getattr access on the directory /var/lib/Pegasus/cache/trace.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that bash should be allowed getattr access on the trace directory by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cmpiLMI_Account /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:pegasus_data_t:s0
>Target Objects                /var/lib/Pegasus/cache/trace [ dir ]
>Source                        cmpiLMI_Account
>Source Path                   /usr/bin/bash
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           bash-4.2.42-1.fc18.x86_64
>Target RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      d92913b7-dfa2-4343-b9d7-2306c1ac20a3
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.89:5932): avc:  denied  { getattr } for  pid=4422 comm="cmpiLMI_Account" path="/var/lib/Pegasus/cache/trace" dev="vda3" ino=170687 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:pegasus_data_t:s0 tclass=dir
>
>
>type=SYSCALL msg=audit(1358843929.89:5932): arch=x86_64 syscall=stat success=yes exit=0 a0=17bcef0 a1=7ffff1b3beb0 a2=7ffff1b3beb0 a3=0 items=0 ppid=4421 pid=4422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cmpiLMI_Account exe=/usr/bin/bash subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cmpiLMI_Account,pegasus_openlmi_account_t,pegasus_data_t,dir,getattr
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t pegasus_data_t:dir getattr;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t pegasus_data_t:dir getattr;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/bin/bash from getattr access on the file /proc/meminfo.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that bash should be allowed getattr access on the meminfo file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cmpiLMI_Account /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:proc_t:s0
>Target Objects                /proc/meminfo [ file ]
>Source                        cmpiLMI_Account
>Source Path                   /usr/bin/bash
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           bash-4.2.42-1.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      029fa987-37ec-4a05-b3fb-83f23d1f30ea
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.89:5931): avc:  denied  { getattr } for  pid=4422 comm="cmpiLMI_Account" path="/proc/meminfo" dev="proc" ino=4026532026 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843929.89:5931): arch=x86_64 syscall=fstat success=yes exit=0 a0=3 a1=7ffff1b39df0 a2=7ffff1b39df0 a3=0 items=0 ppid=4421 pid=4422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cmpiLMI_Account exe=/usr/bin/bash subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cmpiLMI_Account,pegasus_openlmi_account_t,proc_t,file,getattr
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t proc_t:file getattr;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t proc_t:file getattr;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/bin/bash from read access on the file passwd.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that bash should be allowed read access on the passwd file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cmpiLMI_Account /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:passwd_file_t:s0
>Target Objects                passwd [ file ]
>Source                        cmpiLMI_Account
>Source Path                   /usr/bin/bash
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   2
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:52 CET
>Local ID                      309be271-0149-4543-a639-8c00be2ae0d4
>
>Raw Audit Messages
>type=AVC msg=audit(1358843932.492:5989): avc:  denied  { read } for  pid=4427 comm="cimprovagt" name="passwd" dev="vda3" ino=48314 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
>
>
>type=AVC msg=audit(1358843932.492:5989): avc:  denied  { open } for  pid=4427 comm="cimprovagt" path="/etc/passwd" dev="vda3" ino=48314 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843932.492:5989): arch=x86_64 syscall=open success=yes exit=ECHILD a0=7f04bc016210 a1=0 a2=7f04c571bdb0 a3=c items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cmpiLMI_Account,pegasus_openlmi_account_t,passwd_file_t,file,read
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t passwd_file_t:file { read open };
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t passwd_file_t:file { read open };
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/bin/bash from getattr access on the file /etc/passwd.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that bash should be allowed getattr access on the passwd file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cmpiLMI_Account /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:passwd_file_t:s0
>Target Objects                /etc/passwd [ file ]
>Source                        cmpiLMI_Account
>Source Path                   /usr/bin/bash
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           setup-2.8.57-1.fc18.noarch
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   2
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:52 CET
>Local ID                      c3777fbc-571e-4952-89fc-6b9c4d3cf01f
>
>Raw Audit Messages
>type=AVC msg=audit(1358843932.499:5991): avc:  denied  { getattr } for  pid=4427 comm="cimprovagt" path="/etc/passwd" dev="vda3" ino=48314 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843932.499:5991): arch=x86_64 syscall=fstat success=yes exit=0 a0=a a1=7f04c571bbf0 a2=7f04c571bbf0 a3=238 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cmpiLMI_Account,pegasus_openlmi_account_t,passwd_file_t,file,getattr
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t passwd_file_t:file getattr;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t passwd_file_t:file getattr;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/bin/bash from write access on the file account.log.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that bash should be allowed write access on the account.log file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cmpiLMI_Account /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:pegasus_tmp_t:s0
>Target Objects                account.log [ file ]
>Source                        cmpiLMI_Account
>Source Path                   /usr/bin/bash
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           bash-4.2.42-1.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      dc8306bf-312c-4b25-b754-42b0e086af2d
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.94:5935): avc:  denied  { write } for  pid=4422 comm="cmpiLMI_Account" name="account.log" dev="tmpfs" ino=137198 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:pegasus_tmp_t:s0 tclass=file
>
>
>type=AVC msg=audit(1358843929.94:5935): avc:  denied  { open } for  pid=4422 comm="cmpiLMI_Account" path="/tmp/account.log" dev="tmpfs" ino=137198 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:pegasus_tmp_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843929.94:5935): arch=x86_64 syscall=open success=yes exit=ESRCH a0=17c2910 a1=241 a2=1b6 a3=0 items=0 ppid=4421 pid=4422 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cmpiLMI_Account exe=/usr/bin/bash subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cmpiLMI_Account,pegasus_openlmi_account_t,pegasus_tmp_t,file,write
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t pegasus_tmp_t:file { write open };
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t pegasus_tmp_t:file { write open };
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from execute access on the file /usr/libexec/pegasus/cimprovagt.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed execute access on the cimprovagt file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:bin_t:s0
>Target Objects                /usr/libexec/pegasus/cimprovagt [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      0aaec446-889d-4ea6-8b2b-960427e2fa7b
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.94:5936): avc:  denied  { execute } for  pid=4425 comm="cmpiLMI_Account" name="cimprovagt" dev="vda3" ino=9010 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file
>
>
>type=AVC msg=audit(1358843929.94:5936): avc:  denied  { execute_no_trans } for  pid=4425 comm="cmpiLMI_Account" path="/usr/libexec/pegasus/cimprovagt" dev="vda3" ino=9010 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843929.94:5936): arch=x86_64 syscall=execve success=yes exit=0 a0=17c2c20 a1=17c0e00 a2=17c34f0 a3=38 items=0 ppid=4422 pid=4425 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,bin_t,file,execute
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t bin_t:file { execute execute_no_trans };
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t bin_t:file { execute execute_no_trans };
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from using the setgid capability.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should have the setgid capability by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Objects                 [ capability ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      6ae68316-9c8f-4978-90d2-bcc503005642
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.104:5937): avc:  denied  { setgid } for  pid=4425 comm="cimprovagt" capability=6  scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:system_r:pegasus_openlmi_account_t:s0 tclass=capability
>
>
>type=SYSCALL msg=audit(1358843929.104:5937): arch=x86_64 syscall=setgid success=yes exit=0 a0=0 a1=0 a2=3 a3=7fff227a8e90 items=0 ppid=4422 pid=4425 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,pegasus_openlmi_account_t,capability,setgid
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t self:capability setgid;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t self:capability setgid;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from using the setuid capability.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should have the setuid capability by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Objects                 [ capability ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      f340a7a3-23bd-4d50-be8d-ad1c1f47c7e7
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.105:5938): avc:  denied  { setuid } for  pid=4425 comm="cimprovagt" capability=7  scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:system_r:pegasus_openlmi_account_t:s0 tclass=capability
>
>
>type=SYSCALL msg=audit(1358843929.105:5938): arch=x86_64 syscall=setuid success=yes exit=0 a0=0 a1=0 a2=1 a3=7fff227a8e90 items=0 ppid=4422 pid=4425 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,pegasus_openlmi_account_t,capability,setuid
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t self:capability setuid;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t self:capability setuid;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from write access on the directory /var/lib/Pegasus/cache/trace.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed write access on the trace directory by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:pegasus_data_t:s0
>Target Objects                /var/lib/Pegasus/cache/trace [ dir ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      569b220c-fea0-4a9d-81b6-276d91ebd06d
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.119:5939): avc:  denied  { write } for  pid=4426 comm="cimprovagt" name="trace" dev="vda3" ino=170687 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:pegasus_data_t:s0 tclass=dir
>
>
>type=SYSCALL msg=audit(1358843929.119:5939): arch=x86_64 syscall=access success=yes exit=0 a0=7f04c65b21c0 a1=2 a2=7f04c2afe768 a3=7fff74f13e00 items=0 ppid=1 pid=4426 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,pegasus_data_t,dir,write
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t pegasus_data_t:dir write;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t pegasus_data_t:dir write;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from getattr access on the file /etc/resolv.conf.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed getattr access on the resolv.conf file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:net_conf_t:s0
>Target Objects                /etc/resolv.conf [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      00b86462-646c-4d06-acd7-91e8aaa2d701
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.206:5941): avc:  denied  { getattr } for  pid=4427 comm="cimprovagt" path="/etc/resolv.conf" dev="vda3" ino=8290 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843929.206:5941): arch=x86_64 syscall=fstat success=yes exit=0 a0=3 a1=7f04c5719680 a2=7f04c5719680 a3=0 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,net_conf_t,file,getattr
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t net_conf_t:file getattr;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t net_conf_t:file getattr;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from read access on the file /etc/resolv.conf.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed read access on the resolv.conf file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:net_conf_t:s0
>Target Objects                /etc/resolv.conf [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      6069e9d9-99ee-4220-a53f-5254180c0e73
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.206:5940): avc:  denied  { read } for  pid=4427 comm="cimprovagt" name="resolv.conf" dev="vda3" ino=8290 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file
>
>
>type=AVC msg=audit(1358843929.206:5940): avc:  denied  { open } for  pid=4427 comm="cimprovagt" path="/etc/resolv.conf" dev="vda3" ino=8290 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843929.206:5940): arch=x86_64 syscall=open success=yes exit=ESRCH a0=7f04c28c55ad a1=80000 a2=1b6 a3=238 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,net_conf_t,file,read
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t net_conf_t:file { read open };
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t net_conf_t:file { read open };
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from create access on the udp_socket .
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed create access on the  udp_socket by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Objects                 [ udp_socket ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      4d3d721c-0866-4def-898f-884887ac87a9
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.206:5942): avc:  denied  { create } for  pid=4427 comm="cimprovagt" scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:system_r:pegasus_openlmi_account_t:s0 tclass=udp_socket
>
>
>type=SYSCALL msg=audit(1358843929.206:5942): arch=x86_64 syscall=socket success=yes exit=ESRCH a0=2 a1=802 a2=0 a3=7f04c5719680 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,pegasus_openlmi_account_t,udp_socket,create
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t self:udp_socket create;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t self:udp_socket create;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from getattr access on the udp_socket udp_socket.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed getattr access on the udp_socket udp_socket by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Objects                udp_socket [ udp_socket ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      21da68f3-90fb-463c-b396-9be26366c00d
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.207:5944): avc:  denied  { getattr } for  pid=4427 comm="cimprovagt" path="socket:[183104]" dev="sockfs" ino=183104 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:system_r:pegasus_openlmi_account_t:s0 tclass=udp_socket
>
>
>type=SYSCALL msg=audit(1358843929.207:5944): arch=x86_64 syscall=ioctl success=yes exit=0 a0=3 a1=541b a2=7f04c5719a20 a3=7f04c5719680 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,pegasus_openlmi_account_t,udp_socket,getattr
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t self:udp_socket getattr;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t self:udp_socket getattr;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from connect access on the udp_socket .
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed connect access on the  udp_socket by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Objects                 [ udp_socket ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      3feafbe6-9b4f-4744-9407-97bbdf11cfe5
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.207:5943): avc:  denied  { connect } for  pid=4427 comm="cimprovagt" scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:system_r:pegasus_openlmi_account_t:s0 tclass=udp_socket
>
>
>type=SYSCALL msg=audit(1358843929.207:5943): arch=x86_64 syscall=connect success=yes exit=0 a0=3 a1=7f04bc009260 a2=10 a3=7f04c5719680 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,pegasus_openlmi_account_t,udp_socket,connect
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t self:udp_socket connect;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t self:udp_socket connect;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from getattr access on the file /etc/shadow.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed getattr access on the shadow file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:shadow_t:s0
>Target Objects                /etc/shadow [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           setup-2.8.57-1.fc18.noarch
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      4c983169-9aad-4e30-963e-9d7994f18765
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.238:5945): avc:  denied  { getattr } for  pid=4427 comm="cimprovagt" path="/etc/shadow" dev="vda3" ino=1233 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843929.238:5945): arch=x86_64 syscall=stat success=yes exit=0 a0=7f04bc0154e0 a1=7f04c571be40 a2=7f04c571be40 a3=c items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,shadow_t,file,getattr
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t shadow_t:file getattr;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t shadow_t:file getattr;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from lock access on the file /etc/passwd.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed lock access on the passwd file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:passwd_file_t:s0
>Target Objects                /etc/passwd [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           setup-2.8.57-1.fc18.noarch
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   2
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:52 CET
>Local ID                      38d4e201-f0fb-4240-b10e-b001afe3d6fa
>
>Raw Audit Messages
>type=AVC msg=audit(1358843932.499:5990): avc:  denied  { lock } for  pid=4427 comm="cimprovagt" path="/etc/passwd" dev="vda3" ino=48314 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843932.499:5990): arch=x86_64 syscall=fcntl success=yes exit=0 a0=a a1=6 a2=7f04bc016008 a3=28 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,passwd_file_t,file,lock
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t passwd_file_t:file lock;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t passwd_file_t:file lock;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from lock access on the file /etc/shadow.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed lock access on the shadow file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:shadow_t:s0
>Target Objects                /etc/shadow [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           setup-2.8.57-1.fc18.noarch
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      e8855645-a57b-455c-b401-6a96dc77c5e8
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.239:5948): avc:  denied  { lock } for  pid=4427 comm="cimprovagt" path="/etc/shadow" dev="vda3" ino=1233 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843929.239:5948): arch=x86_64 syscall=fcntl success=yes exit=0 a0=3 a1=6 a2=7f04bc0166b8 a3=28 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,shadow_t,file,lock
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t shadow_t:file lock;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t shadow_t:file lock;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from using the dac_override capability.
>
>*****  Plugin dac_override (91.4 confidence) suggests  ***********************
>
>If you want to help identify if domain needs this access or you have a file with the wrong permissions on your system
>Then turn on full auditing to get path information about the offending file and generate the error again.
>Do
>
>Turn on full auditing
># auditctl -w /etc/shadow -p w
>Try to recreate AVC. Then execute
># ausearch -m avc -ts recent
>If you see PATH record check ownership/permissions on file, and fix it, 
>otherwise report as a bugzilla.
>
>*****  Plugin catchall (9.59 confidence) suggests  ***************************
>
>If you believe that cimprovagt should have the dac_override capability by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Objects                 [ capability ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   2
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:54 CET
>Local ID                      e1beeb14-2e31-46b4-b38b-d014e442dde6
>
>Raw Audit Messages
>type=AVC msg=audit(1358843934.282:6020): avc:  denied  { dac_override } for  pid=4427 comm="cimprovagt" capability=1  scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:system_r:pegasus_openlmi_account_t:s0 tclass=capability
>
>
>type=SYSCALL msg=audit(1358843934.282:6020): arch=x86_64 syscall=open success=yes exit=ECHILD a0=7f04bc037230 a1=0 a2=7f04c571c220 a3=d items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,pegasus_openlmi_account_t,capability,dac_override
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t self:capability dac_override;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t self:capability dac_override;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from read access on the file /var/log/wtmp.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed read access on the wtmp file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:wtmp_t:s0
>Target Objects                /var/log/wtmp [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           initscripts-9.42.1-1.fc18.x86_64
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:49 CET
>Last Seen                     2013-01-22 09:38:49 CET
>Local ID                      06825837-6d87-436e-9328-9ed7f698c3ed
>
>Raw Audit Messages
>type=AVC msg=audit(1358843929.242:5949): avc:  denied  { read } for  pid=4427 comm="cimprovagt" name="wtmp" dev="vda3" ino=146104 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:wtmp_t:s0 tclass=file
>
>
>type=AVC msg=audit(1358843929.242:5949): avc:  denied  { open } for  pid=4427 comm="cimprovagt" path="/var/log/wtmp" dev="vda3" ino=146104 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:wtmp_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843929.242:5949): arch=x86_64 syscall=open success=yes exit=ESRCH a0=7f04bc08a240 a1=80000 a2=7f04bc08a240 a3=7f04c571bd30 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,wtmp_t,file,read
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t wtmp_t:file { read open };
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t wtmp_t:file { read open };
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from search access on the directory tog-pegasus.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed search access on the tog-pegasus directory by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:pegasus_var_run_t:s0
>Target Objects                tog-pegasus [ dir ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:50 CET
>Last Seen                     2013-01-22 09:38:50 CET
>Local ID                      71b5690f-2f47-46a9-af5f-5faf851f2861
>
>Raw Audit Messages
>type=AVC msg=audit(1358843930.787:5957): avc:  denied  { search } for  pid=4427 comm="cimprovagt" name="tog-pegasus" dev="tmpfs" ino=12793 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:pegasus_var_run_t:s0 tclass=dir
>
>
>type=AVC msg=audit(1358843930.787:5957): avc:  denied  { write } for  pid=4427 comm="cimprovagt" name="cimxml.socket" dev="tmpfs" ino=183040 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:pegasus_var_run_t:s0 tclass=sock_file
>
>
>type=AVC msg=audit(1358843930.787:5957): avc:  denied  { connectto } for  pid=4427 comm="cimprovagt" path="/run/tog-pegasus/cimxml.socket" scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:system_r:pegasus_t:s0 tclass=unix_stream_socket
>
>
>type=SYSCALL msg=audit(1358843930.787:5957): arch=x86_64 syscall=connect success=yes exit=0 a0=5 a1=7f04c571b390 a2=6e a3=7f04c571ab10 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,pegasus_var_run_t,dir,search
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t pegasus_t:unix_stream_socket connectto;
>allow pegasus_openlmi_account_t pegasus_var_run_t:dir search;
>allow pegasus_openlmi_account_t pegasus_var_run_t:sock_file write;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t pegasus_t:unix_stream_socket connectto;
>allow pegasus_openlmi_account_t pegasus_var_run_t:dir search;
>allow pegasus_openlmi_account_t pegasus_var_run_t:sock_file write;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from read access on the file cimclient_root_1_792.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed read access on the cimclient_root_1_792 file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:pegasus_data_t:s0
>Target Objects                cimclient_root_1_792 [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:50 CET
>Last Seen                     2013-01-22 09:38:50 CET
>Local ID                      822f96b7-9d05-46cc-a408-a2d2dbd8489b
>
>Raw Audit Messages
>type=AVC msg=audit(1358843930.795:5958): avc:  denied  { read } for  pid=4427 comm="cimprovagt" name="cimclient_root_1_792" dev="vda3" ino=163600 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:pegasus_data_t:s0 tclass=file
>
>
>type=AVC msg=audit(1358843930.795:5958): avc:  denied  { open } for  pid=4427 comm="cimprovagt" path="/var/lib/Pegasus/cache/localauth/cimclient_root_1_792" dev="vda3" ino=163600 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:pegasus_data_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843930.795:5958): arch=x86_64 syscall=open success=yes exit=ENXIO a0=7f04bc067c60 a1=0 a2=1b6 a3=238 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,pegasus_data_t,file,read
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t pegasus_data_t:file { read open };
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t pegasus_data_t:file { read open };
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from using the setfscreate access on a process.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed setfscreate access on processes labeled pegasus_openlmi_account_t by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Objects                 [ process ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   2
>First Seen                    2013-01-22 09:38:50 CET
>Last Seen                     2013-01-22 09:38:53 CET
>Local ID                      28dbcf35-04a3-4bbf-8f3a-43d9df27e2c2
>
>Raw Audit Messages
>type=AVC msg=audit(1358843933.776:6011): avc:  denied  { setfscreate } for  pid=4427 comm="cimprovagt" scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:system_r:pegasus_openlmi_account_t:s0 tclass=process
>
>
>type=SYSCALL msg=audit(1358843933.776:6011): arch=x86_64 syscall=write success=yes exit=EDEADLOCK a0=a a1=7f04bc037ce0 a2=23 a3=6165726373662f72 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,pegasus_openlmi_account_t,process,setfscreate
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t self:process setfscreate;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t self:process setfscreate;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from write access on the file /etc/passwd-.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed write access on the passwd- file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:passwd_file_t:s0
>Target Objects                /etc/passwd- [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   2
>First Seen                    2013-01-22 09:38:50 CET
>Last Seen                     2013-01-22 09:38:52 CET
>Local ID                      0ded2ec3-dc80-4ad6-961f-10a913713b15
>
>Raw Audit Messages
>type=AVC msg=audit(1358843932.716:5994): avc:  denied  { write } for  pid=4427 comm="cimprovagt" name="passwd-" dev="vda3" ino=22906 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843932.716:5994): arch=x86_64 syscall=open success=yes exit=ENOMEM a0=7f04bc014cf0 a1=41 a2=81a4 a3=d items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,passwd_file_t,file,write
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t passwd_file_t:file write;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t passwd_file_t:file write;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from setattr access on the file /etc/passwd-.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed setattr access on the passwd- file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:passwd_file_t:s0
>Target Objects                /etc/passwd- [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   2
>First Seen                    2013-01-22 09:38:50 CET
>Last Seen                     2013-01-22 09:38:52 CET
>Local ID                      c449b5e2-12c6-4343-9d90-e1a9d7b95c8e
>
>Raw Audit Messages
>type=AVC msg=audit(1358843932.720:5995): avc:  denied  { setattr } for  pid=4427 comm="cimprovagt" name="passwd-" dev="vda3" ino=22906 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843932.720:5995): arch=x86_64 syscall=fchown success=yes exit=0 a0=c a1=0 a2=0 a3=28 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,passwd_file_t,file,setattr
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t passwd_file_t:file setattr;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t passwd_file_t:file setattr;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from write access on the file /etc/gshadow-.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed write access on the gshadow- file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:shadow_t:s0
>Target Objects                /etc/gshadow- [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:50 CET
>Last Seen                     2013-01-22 09:38:50 CET
>Local ID                      2277823c-4879-464f-8f9c-770fa3d6134e
>
>Raw Audit Messages
>type=AVC msg=audit(1358843930.907:5962): avc:  denied  { write } for  pid=4427 comm="cimprovagt" name="gshadow-" dev="vda3" ino=50 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843930.907:5962): arch=x86_64 syscall=open success=yes exit=ENOMEM a0=7f04bc0230d0 a1=41 a2=8000 a3=e items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,shadow_t,file,write
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t shadow_t:file write;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t shadow_t:file write;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from setattr access on the file /etc/gshadow-.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed setattr access on the gshadow- file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:shadow_t:s0
>Target Objects                /etc/gshadow- [ file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:50 CET
>Last Seen                     2013-01-22 09:38:50 CET
>Local ID                      bb30a8fd-288c-49c5-9a0e-da58610e8e2f
>
>Raw Audit Messages
>type=AVC msg=audit(1358843930.908:5963): avc:  denied  { setattr } for  pid=4427 comm="cimprovagt" name="gshadow-" dev="vda3" ino=50 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1358843930.908:5963): arch=x86_64 syscall=fchown success=yes exit=0 a0=c a1=0 a2=0 a3=28 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,shadow_t,file,setattr
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t shadow_t:file setattr;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t shadow_t:file setattr;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from write access on the directory /home.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed write access on the home directory by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:home_root_t:s0
>Target Objects                /home [ dir ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           filesystem-3.1-2.fc18.x86_64
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:51 CET
>Last Seen                     2013-01-22 09:38:51 CET
>Local ID                      703a46e6-cc9f-43d6-98d8-5e5d46ffb0d0
>
>Raw Audit Messages
>type=AVC msg=audit(1358843931.19:5964): avc:  denied  { write } for  pid=4427 comm="cimprovagt" name="home" dev="vda3" ino=129321 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
>
>
>type=AVC msg=audit(1358843931.19:5964): avc:  denied  { add_name } for  pid=4427 comm="cimprovagt" name="account_test_user" scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
>
>
>type=AVC msg=audit(1358843931.19:5964): avc:  denied  { create } for  pid=4427 comm="cimprovagt" name="account_test_user" scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
>
>
>type=SYSCALL msg=audit(1358843931.19:5964): arch=x86_64 syscall=mkdir success=yes exit=0 a0=7f04bc030550 a1=1c0 a2=0 a3=7f04c571b6d0 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,home_root_t,dir,write
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t home_root_t:dir { write create add_name };
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t home_root_t:dir { write create add_name };
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from setattr access on the directory account_test_user.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed setattr access on the account_test_user directory by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:home_root_t:s0
>Target Objects                account_test_user [ dir ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:51 CET
>Last Seen                     2013-01-22 09:38:51 CET
>Local ID                      60e0b910-b284-4f5c-ac96-c4d38d643522
>
>Raw Audit Messages
>type=AVC msg=audit(1358843931.20:5965): avc:  denied  { setattr } for  pid=4427 comm="cimprovagt" name="account_test_user" dev="vda3" ino=210108 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
>
>
>type=AVC msg=audit(1358843931.20:5965): avc:  denied  { chown } for  pid=4427 comm="cimprovagt" capability=0  scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:system_r:pegasus_openlmi_account_t:s0 tclass=capability
>
>
>type=SYSCALL msg=audit(1358843931.20:5965): arch=x86_64 syscall=chown success=yes exit=0 a0=7f04bc030550 a1=3ed a2=3e9 a3=7f04c571b6d0 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,home_root_t,dir,setattr
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t home_root_t:dir setattr;
>allow pegasus_openlmi_account_t self:capability chown;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t home_root_t:dir setattr;
>allow pegasus_openlmi_account_t self:capability chown;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/sbin/userdel from rmdir access on the directory account_test_user.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that userdel should be allowed rmdir access on the account_test_user directory by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep userdel /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:home_root_t:s0
>Target Objects                account_test_user [ dir ]
>Source                        userdel
>Source Path                   /usr/sbin/userdel
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           shadow-utils-4.1.5.1-1.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:51 CET
>Last Seen                     2013-01-22 09:38:51 CET
>Local ID                      ea137ec4-b6fc-4a37-92e2-864ec5874a30
>
>Raw Audit Messages
>type=AVC msg=audit(1358843931.103:5969): avc:  denied  { rmdir } for  pid=4515 comm="userdel" name="account_test_user" dev="vda3" ino=210108 scontext=unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
>
>
>type=SYSCALL msg=audit(1358843931.103:5969): arch=x86_64 syscall=rmdir success=yes exit=0 a0=7fd1ce0805e0 a1=0 a2=6700 a3=8028 items=0 ppid=4417 pid=4515 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=20 comm=userdel exe=/usr/sbin/userdel subj=unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023 key=(null)
>
>Hash: userdel,useradd_t,home_root_t,dir,rmdir
>
>audit2allow
>
>#============= useradd_t ==============
>allow useradd_t home_root_t:dir rmdir;
>
>audit2allow -R
>
>#============= useradd_t ==============
>allow useradd_t home_root_t:dir rmdir;
>
>
>--------------------------------------------------------------------------------
>
>SELinux is preventing /usr/libexec/pegasus/cimprovagt from write access on the sock_file cimxml.socket.
>
>*****  Plugin catchall (100. confidence) suggests  ***************************
>
>If you believe that cimprovagt should be allowed write access on the cimxml.socket sock_file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep cimprovagt /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>
>Additional Information:
>Source Context                system_u:system_r:pegasus_openlmi_account_t:s0
>Target Context                system_u:object_r:pegasus_var_run_t:s0
>Target Objects                cimxml.socket [ sock_file ]
>Source                        cimprovagt
>Source Path                   /usr/libexec/pegasus/cimprovagt
>Port                          <Unknown>
>Host                          <Unknown>
>Source RPM Packages           tog-pegasus-2.12.0-4.fc18.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.11.1-67.fc18.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Permissive
>Host Name                     f18
>Platform                      Linux f18 3.6.9-4.fc18.x86_64 #1 SMP Tue Dec 4
>                              14:12:51 UTC 2012 x86_64 x86_64
>Alert Count                   1
>First Seen                    2013-01-22 09:38:55 CET
>Last Seen                     2013-01-22 09:38:55 CET
>Local ID                      523982c1-8ca8-4196-85f9-2347f9236ed1
>
>Raw Audit Messages
>type=AVC msg=audit(1358843935.543:6038): avc:  denied  { write } for  pid=4427 comm="cimprovagt" name="cimxml.socket" dev="tmpfs" ino=183040 scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:object_r:pegasus_var_run_t:s0 tclass=sock_file
>
>
>type=AVC msg=audit(1358843935.543:6038): avc:  denied  { connectto } for  pid=4427 comm="cimprovagt" path="/run/tog-pegasus/cimxml.socket" scontext=system_u:system_r:pegasus_openlmi_account_t:s0 tcontext=system_u:system_r:pegasus_t:s0 tclass=unix_stream_socket
>
>
>type=SYSCALL msg=audit(1358843935.543:6038): arch=x86_64 syscall=connect success=yes exit=0 a0=d a1=7f04c571b710 a2=6e a3=20 items=0 ppid=1 pid=4427 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=cimprovagt exe=/usr/libexec/pegasus/cimprovagt subj=system_u:system_r:pegasus_openlmi_account_t:s0 key=(null)
>
>Hash: cimprovagt,pegasus_openlmi_account_t,pegasus_var_run_t,sock_file,write
>
>audit2allow
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t pegasus_t:unix_stream_socket connectto;
>allow pegasus_openlmi_account_t pegasus_var_run_t:sock_file write;
>
>audit2allow -R
>
>#============= pegasus_openlmi_account_t ==============
>allow pegasus_openlmi_account_t pegasus_t:unix_stream_socket connectto;
>allow pegasus_openlmi_account_t pegasus_var_run_t:sock_file write;
>
>

Actions: View

Attachments on bug 896624: 680328 | 680355 | 684235 | 685010 | 685017