Bug 546143

Zusammenfassung:

SELinux is preventing /usr/libexec/polkit-gnome-authentication-agent-1 "search"
access on /home.

Detaillierte Beschreibung:

[polkit-gnome-au hat einen toleranten Typ (policykit_auth_t). Dieser Zugriff
wurde nicht verweigert.]

SELinux denied access requested by polkit-gnome-au. It is not expected that this
access is required by polkit-gnome-au and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Zugriff erlauben:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug
report.

Zusätzliche Informationen:

Quellkontext                  unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c
                              0.c1023
Zielkontext                   system_u:object_r:home_root_t:s0
Zielobjekte                   /home [ dir ]
Quelle                        polkit-gnome-au
Quellen-Pfad                  /usr/libexec/polkit-gnome-authentication-agent-1
Port                          <Unbekannt>
Host                          (removed)
Quellen-RPM-Pakete            polkit-gnome-0.95-0.git20090913.6.fc12
Ziel-RPM-Pakete               filesystem-2.4.30-2.fc12
RPM-Richtlinie                selinux-policy-3.6.32-55.fc12
SELinux aktiviert             True
Richtlinienversion            targeted
Enforcing-Modus               Enforcing
Plugin-Name                   catchall
Hostname                      (removed)
Plattform                     Linux (removed) 2.6.31.6-162.fc12.x86_64 #1 SMP Fri Dec
                              4 00:06:26 EST 2009 x86_64 x86_64
Anzahl der Alarme             30
Zuerst gesehen                Do 10 Dez 2009 07:26:26 CET
Zuletzt gesehen               Do 10 Dez 2009 07:26:26 CET
Lokale ID                     1bb3ef64-1f69-4e56-9e58-dee6e87fc58e
Zeilennummern                 

Raw-Audit-Meldungen           

node=(removed) type=AVC msg=audit(1260426386.297:26154): avc:  denied  { search } for  pid=1728 comm="polkit-gnome-au" name="/" dev=sda7 ino=2 scontext=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:home_root_t:s0 tclass=dir

node=(removed) type=SYSCALL msg=audit(1260426386.297:26154): arch=c000003e syscall=21 success=yes exit=128 a0=12d9fe0 a1=0 a2=12d9ed0 a3=1 items=0 ppid=1571 pid=1728 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="polkit-gnome-au" exe="/usr/libexec/polkit-gnome-authentication-agent-1" subj=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.6.32-55.fc12,catchall,polkit-gnome-au,policykit_auth_t,home_root_t,dir,search
audit2allow suggests:

#============= policykit_auth_t ==============
allow policykit_auth_t home_root_t:dir search;