Bug 430195

What avc messages are you seeing in /var/log/audit/audit.log?

Created attachment 293039 [details]
audit log file

I was not able to figure out what was being block related to the Gnome audio
control. But in looking through the log it looks like there were other issues;
ntpd and hal were also being blocked. Blocking hal may have caused the audio
control issue. I can also supply the /var/log/messages file if that will help.

Looks like you have a labeling problem here also.

You can relabel this entire machine by executing

touch /.autorelabel; reboot

But I did do a touch of /.autorelabel before reboot. Which brings up a point.
How does the labeling keep getting screwed up?

I have no idea.  Do you have /var/lib as a symbolic link into  a /home
directory?  Or do you have an entry in passwd file with a homedir in /var/lib?

No, /var/lib is not a symbolic link. Yes there are the following passwd file
entries with /var/lib as there home directory:
rpm:x:37:37:RPM user:/var/lib/rpm:/sbin/nologin
hsqldb:x:96:96::/var/lib/hsqldb:/sbin/nologin
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:4294967294:4294967294:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
backuppc:x:495:491::/var/lib/BackupPC:/usr/bin/nologin
clamav:x:493:487:Clamav database update user:/var/lib/clamav:/sbin/nologin
mythtv:x:1004:1004::/var/lib/mythtv:/bin/bash
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin

mythtv:x:1004:1004::/var/lib/mythtv:/bin/bash

is causing the problem.

Change its shell to /sbin/nologin
Then run

# semodule -B
# restorecon -R -v /var/lib

This should fix the labeling.

semodule is trying to figure out where real home directories are located, and
then labeling them correctly.  This homedir is causing a problem since it sets
the labeling on /var/lib to be a homedir.  The tool should have cought this and
printed an error.  This is a regression and I will look into it.

The tools figure out what is a real homedir by looking at the UID < 500 or a
invalid login shell.

Dan, I did another touch /.autorelabel and reboot but still get messed up
labels. The issue seems to be tied to the passwd file entries above. As you can
see I did not chose the location for the home directories. Many daemons launched
as root now use the passwd file to determine what user to run as. They have a
home directory which many never use which could be /dev/null. Others like msql
and clamav do use there home directories. This get back to one of the long
standing issues. Where are home directories physically located are they a normal
user home directory or a service daemon home directory, how and what to label.

Dan, I will try the other steps tonight of:
# semodule -B
# restorecon -R -v /var/lib

If you look at bug report 430194 it seems to be the same issue involving
setroubleshoot with /var/lib/rpm/Packages.

Yes any service that uses a homedir but has a UID < 500 will be ignored.  The
problem is services with UID > 512 and a login shell.  So if you change their
login shells to /sbin/nologin or /bin/false.  SELinux will setup the correct
labeling.

Changing the shell and relabeling has fixed most issues. I did do a touch of
/.autorelabel as the home directories got mislabeled by doing the above steps.
There is another label issue and setroubleshoot does not suggest a fix for it. I
created the directories /export/home where the real home directory storage get
mounted at boot time. They are currently labeled default_t which seems to be an
issue. What is the fix for this one?

# semanage fcontext -a -t home_root_t /export
# restorecon /export

Should fix it.

It did fix it. Solving one label/context issue just seems to lead to the next one.