+++ This bug was initially created as a clone of Bug #648653 +++
--- Additional comment from davej on 2011-03-18 20:16:55 EDT ---
I just realized that /var/lock is now on tmpfs in f16. This is causing things like mrtg to fail..
type=AVC msg=audit(1300493461.829:2068): avc: denied { write } for pid=5105 comm="mrtg" name="/" dev=tmpfs ino=7673 scontext=system_u:system_r:mrtg_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lock_t:s0 tclass=dir
--- Additional comment from eparis on 2011-03-21 14:59:42 EDT ---
Comment #14 doesn't look related to tmpfs. I also see what appear to be proper rules for this in selinux-policy-targeted-3.9.16-3.fc16.noarch. What policy do you have? If you are still having trouble what do you get from
sesearch --type --allow --source mrtg_t --target var_log_t --class dir
--- Additional comment from davej on 2011-03-21 15:11:04 EDT ---
selinux-policy-targeted-3.9.16-5.fc16.noarch
Found 2 semantic av rules:
allow domain var_log_t : dir { getattr search open } ;
allow mrtg_t var_log_t : dir { ioctl read write getattr lock add_name remove_name search open } ;
Found 1 semantic te rules:
type_transition mrtg_t var_log_t : dir mrtg_log_t;
wait, did you mean var_lock_t maybe ?
because that shows..
Found 1 semantic av rules:
allow mrtg_t var_lock_t : dir { getattr search open } ;
which doesn't have a 'write', which would explain the denial.
-------------------------------------------------------------------------
Looks like mrtg_t needs both a te rule and a type transition rule to fix this....