Bug 426823

Description of problem:
SELinux now (after recent upgrade) generates blizzards of syslog messages about
seemingly innocuous operations. operates usually complete OK, but it washes out
other (possibly important) messages in the syslog file.

Version-Release number of selected component (if applicable):
selinux-policy-2.6.4-8.fc7

How reproducible: a bit difficult, I suppose you would need my actual setup. I
upgraded a bunch of stuff (manually) a few days ago & started noticing torrents
of messages from SELinux soon afterward.


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info: Here is the SYSLOG entry for 1 message:

Dec 26 17:16:59 Q6600 setroubleshoot:      SELinux is preventing
/usr/sbin/rpc.mountd (nfsd_t) "getattr" to /dev/sdc1 (fixed_disk_device_t).    
 For complete SELinux messages. run sealert -l 6464b3f6-26e5-46b7-85c2-5ae9be05738c

& here is the sealert output:

[root@Q6600:/etc, Wed Dec 26, 05:17 PM] 1113 # sealert -l
6464b3f6-26e5-46b7-85c2-5ae9be05738c
Summary
    SELinux is preventing /usr/sbin/rpc.mountd (nfsd_t) "getattr" to /dev/sdc1
    (fixed_disk_device_t).

Detailed Description
    SELinux denied access requested by /usr/sbin/rpc.mountd. It is not expected
    that this access is required by /usr/sbin/rpc.mountd and this access may
    signal an intrusion attempt. It is also possible that the specific version
    or configuration of the application is causing it to require additional
    access.

Allowing Access
    Sometimes labeling problems can cause SELinux denials.  You could try to
    restore the default system file context for /dev/sdc1, restorecon -v
    /dev/sdc1 If this does not work, there is currently no automatic way to
    allow this access. Instead,  you can generate a local policy module to allow
    this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385
    Or you can disable SELinux protection altogether. Disabling SELinux
    protection is not recommended. Please file a
    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.

Additional Information        

Source Context                system_u:system_r:nfsd_t
Target Context                system_u:object_r:fixed_disk_device_t
Target Objects                /dev/sdc1 [ blk_file ]
Affected RPM Packages         nfs-utils-1.1.0-4.fc7 [application]
Policy RPM                    selinux-policy-2.6.4-8.fc7
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   plugins.catchall_file
Host Name                     Q6600
Platform                      Linux Q6600 2.6.22.9-91.fc7 #1 SMP Thu Sep 27
                              20:47:39 EDT 2007 x86_64 x86_64
Alert Count                   79
First Seen                    Sat Dec 22 21:00:29 2007
Last Seen                     Wed Dec 26 17:16:55 2007
Local ID                      6464b3f6-26e5-46b7-85c2-5ae9be05738c
Line Numbers                  

Raw Audit Messages

avc: denied { getattr } for comm="rpc.mountd" dev=tmpfs egid=0 euid=0
exe="/usr/sbin/rpc.mountd" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name="sdc1"
path="/dev/sdc1" pid=2815 scontext=system_u:system_r:nfsd_t:s0 sgid=0
subj=system_u:system_r:nfsd_t:s0 suid=0 tclass=blk_file
tcontext=system_u:object_r:fixed_disk_device_t:s0 tty=(none) uid=0

This only started happening after last update about 4 days ago, everything was
quiet (& enforcing) before that ....