Bug 707090

Summary: AVC denials on login
Product: [Fedora] Fedora Reporter: Mike Iglesias <iglesias>
Component: selinux-policy-targetedAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED DUPLICATE QA Contact: Ben Levenson <benl>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 14CC: dwalsh
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-05-24 06:03:07 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Mike Iglesias 2011-05-24 02:18:16 UTC 
Description of problem:

I upgraded a system from F13 to F14 today via preupgrade.  When I log in, I get about 30-40 AVC denial alerts.  On seeing this, I did

# touch /.autorelabel
# reboot

The system rebooted and did the relabel process.  I still get the AVC denials.  The system is in permissive mode so it still works, it's just annoying to get all the AVC alerts.


$ id
uid=500(iglesias) gid=500(iglesias) groups=500(iglesias) context=unconfined_u:system_r:abrt_helper_t:s0-s0:c0.c1023

That looks somewhat odd, but I have no idea how to fix it.


Version-Release number of selected component (if applicable):

Linux nlinux 2.6.35.13-91.fc14.i686 #1 SMP Tue May 3 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux

libselinux-utils-2.0.96-6.fc14.1.i686
selinux-policy-targeted-3.9.7-40.fc14.noarch
libselinux-python-2.0.96-6.fc14.1.i686
selinux-policy-3.9.7-40.fc14.noarch
libselinux-2.0.96-6.fc14.1.i686
libselinux-devel-2.0.96-6.fc14.1.i686


Additional info:

here's a smattering of the errors in /var/log/messages:

May 23 18:34:18 localhost audispd: queue is full - dropping event
May 23 18:34:20 localhost setroubleshoot: SELinux is preventing /usr/bin/gnome-k
eyring-daemon from entrypoint access on the file /usr/bin/gnome-keyring-daemon. 
For complete SELinux messages. run sealert -l f9909025-9473-4c49-9c35-68beb9ed52
e3
May 23 18:34:20 localhost setroubleshoot: SELinux is preventing /usr/bin/gnome-k
eyring-daemon from write access on the directory /tmp. For complete SELinux mess
ages. run sealert -l 843efe36-2ddf-46a1-979f-e9e19a37aab1
May 23 18:34:21 localhost setroubleshoot: SELinux is preventing /usr/bin/gnome-k
eyring-daemon from write access on the directory /tmp. For complete SELinux mess
ages. run sealert -l 843efe36-2ddf-46a1-979f-e9e19a37aab1
May 23 18:34:21 localhost setroubleshoot: SELinux is preventing /usr/bin/gnome-k
eyring-daemon from write access on the directory /tmp. For complete SELinux mess
ages. run sealert -l 843efe36-2ddf-46a1-979f-e9e19a37aab1
May 23 18:34:21 localhost setroubleshoot: SELinux is preventing /usr/bin/gnome-k
eyring-daemon from write access on the directory keyring-Yqa5Au. For complete SE
Linux messages. run sealert -l 7dede548-8cc4-4fb2-9cec-0a645c339b9d
May 23 18:34:22 localhost setroubleshoot: SELinux is preventing /usr/bin/gnome-k
eyring-daemon from write access on the directory keyring-Yqa5Au. For complete SE
Linux messages. run sealert -l 7dede548-8cc4-4fb2-9cec-0a645c339b9d
Comment 1 Miroslav Grepl 2011-05-24 06:02:54 UTC 
Could you execute these steps

# setenforce 0
# rm -rf /etc/selinux/targeted
# yum reinstall selinux-policy-targeted
# fixfiles restore
# reboot
Comment 2 Miroslav Grepl 2011-05-24 06:03:07 UTC 

*** This bug has been marked as a duplicate of bug 702865 ***
Comment 3 Mike Iglesias 2011-05-24 14:56:25 UTC 
(In reply to comment #1)
> Could you execute these steps
> 
> # setenforce 0
> # rm -rf /etc/selinux/targeted
> # yum reinstall selinux-policy-targeted
> # fixfiles restore
> # reboot

That appears to have fixed the problem.  Thanks!