Bug 627751

Summary:

SELinux is preventing /bin/bash "getattr" access on /sbin/modprobe.

Detailed Description:

[SELinux is in permissive mode. This access was not denied.]

SELinux denied access requested by governor-max-fr. It is not expected that this
access is required by governor-max-fr and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                system_u:system_r:devicekit_power_t:s0
Target Context                system_u:object_r:insmod_exec_t:s0
Target Objects                /sbin/modprobe [ file ]
Source                        governor-max-fr
Source Path                   /bin/bash
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           bash-4.1.7-3.fc14
Target RPM Packages           module-init-tools-3.11.1-2.fc13
Policy RPM                    selinux-policy-3.8.8-20.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.4-11.rc1.fc14.x86_64 #1 SMP
                              Wed Aug 25 12:24:12 UTC 2010 x86_64 x86_64
Alert Count                   1
First Seen                    Thu 26 Aug 2010 01:32:31 PM PDT
Last Seen                     Thu 26 Aug 2010 01:32:31 PM PDT
Local ID                      07d2ba52-cd68-4846-8d70-5592c2cbb005
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1282854751.730:5): avc:  denied  { getattr } for  pid=1701 comm="governor-max-fr" path="/sbin/modprobe" dev=dm-0 ino=20569 scontext=system_u:system_r:devicekit_power_t:s0 tcontext=system_u:object_r:insmod_exec_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1282854751.730:5): arch=c000003e syscall=4 success=yes exit=0 a0=1533b60 a1=7ffff2d064e0 a2=7ffff2d064e0 a3=38df333150 items=0 ppid=1686 pid=1701 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="governor-max-fr" exe="/bin/bash" subj=system_u:system_r:devicekit_power_t:s0 key=(null)



Hash String generated from  catchall,governor-max-fr,devicekit_power_t,insmod_exec_t,file,getattr
audit2allow suggests:

#============= devicekit_power_t ==============
allow devicekit_power_t insmod_exec_t:file getattr;