Bug 606118

Summary:

SELinux is preventing /usr/bin/python "read" access on
/etc/selinux/mls/policy/policy.24.

Detailed Description:

[SELinux is in permissive mode. This access was not denied.]

SELinux denied access requested by audit2allow. It is not expected that this
access is required by audit2allow and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                user_u:user_r:user_t:s0
Target Context                system_u:object_r:semanage_store_t:s0
Target Objects                /etc/selinux/mls/policy/policy.24 [ file ]
Source                        audit2allow
Source Path                   /usr/bin/python
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           python-2.6.2-4.fc12
Target RPM Packages           selinux-policy-mls-3.6.32-116.fc12
Policy RPM                    selinux-policy-3.6.32-116.fc12
Selinux Enabled               True
Policy Type                   mls
Enforcing Mode                Permissive
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux (removed) 2.6.32.12-115.fc12.x86_64 #1 SMP Fri
                              Apr 30 19:46:25 UTC 2010 x86_64 x86_64
Alert Count                   2
First Seen                    Dydd Sul 20 mis Mehefin 2010 19:31:09 BST
Last Seen                     Dydd Sul 20 mis Mehefin 2010 19:31:09 BST
Local ID                      774a9356-dcb3-4bfb-9f91-a86164779ead
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1277058669.499:5140): avc:  denied  { read } for  pid=27709 comm="audit2allow" name="policy.24" dev=md3 ino=5082096 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:semanage_store_t:s0 tclass=file

node=(removed) type=AVC msg=audit(1277058669.499:5140): avc:  denied  { open } for  pid=27709 comm="audit2allow" name="policy.24" dev=md3 ino=5082096 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:semanage_store_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1277058669.499:5140): arch=c000003e syscall=2 success=yes exit=4294967424 a0=7fff7a305220 a1=0 a2=1b6 a3=0 items=0 ppid=27708 pid=27709 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=140 comm="audit2allow" exe="/usr/bin/python" subj=user_u:user_r:user_t:s0 key=(null)



Hash String generated from  catchall,audit2allow,user_t,semanage_store_t,file,read
audit2allow suggests:

#============= user_t ==============
allow user_t semanage_store_t:file { read open };