Bug 579940

Summary:

SELinux is preventing /sbin/consoletype access to a leaked fifo_file file
descriptor.

Detailed Description:

[consoletype has a permissive type (consoletype_t). This access was not denied.]

SELinux denied access requested by the consoletype command. It looks like this
is either a leaked descriptor or consoletype output was redirected to a file it
is not allowed to access. Leaks usually can be ignored since SELinux is just
closing the leak and reporting the error. The application does not use the
descriptor, so it will run properly. If this is a redirection, you will not get
output in the fifo_file. You should generate a bugzilla on selinux-policy, and
it will get routed to the appropriate package. You can safely ignore this avc.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385)

Additional Information:

Source Context                system_u:system_r:consoletype_t:s0
Target Context                system_u:system_r:NetworkManager_t:s0
Target Objects                fifo_file [ fifo_file ]
Source                        consoletype
Source Path                   /sbin/consoletype
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           initscripts-9.02.1-1
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.32-106.fc12
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   leaks
Host Name                     (removed)
Platform                      Linux (removed) 2.6.32.10-90.fc12.x86_64 #1 SMP Tue Mar
                              23 09:47:08 UTC 2010 x86_64 x86_64
Alert Count                   28
First Seen                    Tue 06 Apr 2010 08:52:47 PM EDT
Last Seen                     Tue 06 Apr 2010 09:38:54 PM EDT
Local ID                      70845c6f-8cab-4650-a70f-82f05fc29287
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1270604334.964:29): avc:  denied  { read } for  pid=3239 comm="consoletype" path="pipe:[66472]" dev=pipefs ino=66472 scontext=system_u:system_r:consoletype_t:s0 tcontext=system_u:system_r:NetworkManager_t:s0 tclass=fifo_file

node=(removed) type=AVC msg=audit(1270604334.964:29): avc:  denied  { write } for  pid=3239 comm="consoletype" path="pipe:[66473]" dev=pipefs ino=66473 scontext=system_u:system_r:consoletype_t:s0 tcontext=system_u:system_r:NetworkManager_t:s0 tclass=fifo_file

node=(removed) type=SYSCALL msg=audit(1270604334.964:29): arch=c000003e syscall=59 success=yes exit=0 a0=13454d0 a1=1347210 a2=134b5c0 a3=7fff2e3a3440 items=0 ppid=3238 pid=3239 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="consoletype" exe="/sbin/consoletype" subj=system_u:system_r:consoletype_t:s0 key=(null)



Hash String generated from  leaks,consoletype,consoletype_t,NetworkManager_t,fifo_file,read
audit2allow suggests:

#============= consoletype_t ==============
allow consoletype_t NetworkManager_t:fifo_file { read write };