Bug 689564

+++ This bug was initially created as a clone of Bug #648653 +++

--- Additional comment from davej on 2011-03-18 20:16:55 EDT ---

I just realized that /var/lock is now on tmpfs in f16.  This is causing things like mrtg to fail..


type=AVC msg=audit(1300493461.829:2068): avc:  denied  { write } for  pid=5105 comm="mrtg" name="/" dev=tmpfs ino=7673 scontext=system_u:system_r:mrtg_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lock_t:s0 tclass=dir

--- Additional comment from eparis on 2011-03-21 14:59:42 EDT ---

Comment #14 doesn't look related to tmpfs.  I also see what appear to be proper rules for this in selinux-policy-targeted-3.9.16-3.fc16.noarch.  What policy do you have?  If you are still having trouble what do you get from

sesearch --type --allow --source mrtg_t --target var_log_t --class dir

--- Additional comment from davej on 2011-03-21 15:11:04 EDT ---

selinux-policy-targeted-3.9.16-5.fc16.noarch

Found 2 semantic av rules:
   allow domain var_log_t : dir { getattr search open } ; 
   allow mrtg_t var_log_t : dir { ioctl read write getattr lock add_name remove_name search open } ; 

Found 1 semantic te rules:
   type_transition mrtg_t var_log_t : dir mrtg_log_t; 


wait, did you mean var_lock_t maybe  ?

because that shows..

Found 1 semantic av rules:
   allow mrtg_t var_lock_t : dir { getattr search open } ; 

which doesn't have a 'write', which would explain the denial.

-------------------------------------------------------------------------

Looks like mrtg_t needs both a te rule and a type transition rule to fix this....