Bug 549602

Summary:

SELinux is preventing /usr/bin/updatedb "read" access on Documents and Settings.

Detailed Description:

SELinux denied access requested by updatedb. It is not expected that this access
is required by updatedb and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                system_u:system_r:locate_t:s0-s0:c0.c1023
Target Context                system_u:object_r:fusefs_t:s0
Target Objects                Documents and Settings [ lnk_file ]
Source                        updatedb
Source Path                   /usr/bin/updatedb
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           mlocate-0.22.2-1.fc12
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.32-56.fc12
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.31.6-166.fc12.x86_64 #1 SMP Wed Dec 9 10:46:22
                              EST 2009 x86_64 x86_64
Alert Count                   2
First Seen                    Mon 21 Dec 2009 05:48:49 AM CET
Last Seen                     Tue 22 Dec 2009 03:50:13 AM CET
Local ID                      226594a1-2bc4-4a0c-896a-9b4456fe40c8
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1261450213.298:126): avc:  denied  { read } for  pid=9980 comm="updatedb" name=446F63756D656E747320616E642053657474696E6773 dev=sdc2 ino=9642 scontext=system_u:system_r:locate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fusefs_t:s0 tclass=lnk_file

node=(removed) type=SYSCALL msg=audit(1261450213.298:126): arch=c000003e syscall=80 success=no exit=-13 a0=14d1879 a1=14d1879 a2=7fffd564aad0 a3=358f71c860 items=0 ppid=9974 pid=9980 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=11 comm="updatedb" exe="/usr/bin/updatedb" subj=system_u:system_r:locate_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.6.32-56.fc12,catchall,updatedb,locate_t,fusefs_t,lnk_file,read
audit2allow suggests:

#============= locate_t ==============
allow locate_t fusefs_t:lnk_file read;