Bug 714738

SELinux is preventing /usr/sbin/NetworkManager from 'getattr' accesses on the file /etc/NetworkManager/VPN/nm-vpnc-service.name.

*****  Plugin restorecon (94.8 confidence) suggests  *************************

If you want to fix the label. 
/etc/NetworkManager/VPN/nm-vpnc-service.name default label should be NetworkManager_var_lib_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /etc/NetworkManager/VPN/nm-vpnc-service.name

*****  Plugin catchall_labels (5.21 confidence) suggests  ********************

If you want to allow NetworkManager to have getattr access on the nm-vpnc-service.name file
Then you need to change the label on /etc/NetworkManager/VPN/nm-vpnc-service.name
Do
# semanage fcontext -a -t FILE_TYPE '/etc/NetworkManager/VPN/nm-vpnc-service.name'
where FILE_TYPE is one of the following: postfix_virtual_t, dovecot_deliver_t, ifconfig_t, sandbox_min_t, sandbox_net_t, sandbox_web_t, user_seunshare_t, xguest_java_t, xguest_mono_t, logwatch_mail_t, cupsd_lpd_t, postfix_map_t, abrt_helper_exec_t, qmail_clean_t, qmail_local_t, qmail_smtpd_t, qmail_start_t, sandbox_xserver_t, automount_t, telepathy_sofiasip_t, fetchmail_t, netlogond_t, puppetmaster_t, amanda_t, udev_exec_t, amavis_t, system_mail_t, locale_t, locate_t, logadm_t, mcelog_t, nagios_t, varnishd_t, httpd_squid_script_t, user_tmp_t, setkey_t, sysadm_t, tvtime_t, tzdata_t, vmware_t, restorecond_t, webadm_t, afs_t, xdm_dbusd_t, aiccu_t, aide_t, alsa_t, gpg_helper_t, amtu_t, apm_t, avahi_t, boinc_t, canna_t, staff_ssh_agent_t, ccs_t, cdcc_t, crack_t, cvs_t, cyrus_t, dccm_t, portreserve_t, dhcpc_t, dmesg_t, etc_t, exim_t, games_t, getty_t, gpg_t, gpm_t, ipsec_t, irc_t, irssi_t, java_t, cpufreqselector_t, readahead_t, mrtg_t, ndc_t, named_cache_t, nrpe_t, pads_t, pam_t, ping_t, postfix_postdrop_t, postfix_postqueue_t, proc_t, qemu_t, quota_t, rdisc_t, ricci_t, rsync_t, rwho_t, spamc_t, src_t, sysfs_t, vpnc_t, xdm_t, xfs_t, xm_t, zebra_t, staff_screen_t, system_dbusd_t, setroubleshoot_fixit_t, entropyd_t, staff_dbusd_t, xenstored_t, sandbox_min_client_t, postfix_pipe_t, ifconfig_exec_t, httpd_nagios_script_t, NetworkManager_exec_t, afs_fsserver_t, cpuspeed_t, NetworkManager_tmp_t, nagios_admin_plugin_t, guest_dbusd_t, krb5_conf_t, qmail_splogger_t, prelink_cron_system_t, xguest_dbusd_t, cups_pdf_t, freshclam_t, postgresql_t, ld_so_t, pppd_initrc_exec_t, sysadm_ssh_agent_t, system_cronjob_var_lib_t, cachefiles_kernel_t, courier_pcp_t, courier_pop_t, httpd_dirsrvadmin_script_t, git_system_t, httpd_suexec_t, matahari_hostd_t, publicfile_t, abrt_helper_t, usbmodules_t, sysctl_net_t, textrel_shlib_t, policykit_var_lib_t, nscd_exec_t, usernetctl_t, certwatch_t, rpm_exec_t, sambagui_t, staff_seunshare_t, nx_server_ssh_t, updfstab_t, certmaster_t, certmonger_t, setfiles_t, user_mail_t, cdrecord_t, user_dbusd_t, sectoolm_t, semanage_t, firewallgui_t, checkpolicy_t, portmap_helper_t, utempter_t, setsebool_t, dhcp_etc_t, cobblerd_t, consoletype_t, telepathy_idle_t, xenconsoled_t, clamscan_t, cmirrord_t, rpm_script_tmp_t, telepathy_mission_control_t, webalizer_t, cronjob_t, crontab_t, cpucontrol_t, dnsmasq_exec_t, logrotate_mail_t, matahari_netd_t, passenger_t, arpwatch_t, cardmgr_t, gconfdefaultsm_t, cgclear_t, sftpd_anon_t, chronyd_t, apcupsd_t, matahari_serviced_t, user_home_t, fingerd_t, gpg_web_t, fprintd_t, udev_tbl_t, ftpdctl_t, httpd_cobbler_script_t, dcerpcd_t, httpd_php_t, dovecot_t, evtchnd_t, gpg_agent_t, telepathy_msn_t, auditctl_t, jabberd_t, kadmind_t, hddtemp_t, spamass_milter_t, iceauth_t, icecast_t, prelude_correlator_t, ncftool_t, openoffice_t, openvpn_t, postgrey_t, denyhosts_t, vpnc_exec_t, init_script_file_type, lockdev_t, shell_exec_t, mplayer_t, memcached_t, xguest_openoffice_t, ipsec_mgmt_exec_t, irqbalance_t, radiusd_t, rlogind_t, roundup_t, srvsvcd_t, stunnel_t, dirsrv_snmp_t, sulogin_t, dirsrvadmin_t, svc_run_t, syslogd_t, sysstat_t, smbcontrol_t, nut_upsdrvctl_t, dhcpc_exec_t, rpcbind_t, sandbox_t, portmap_t, pppd_exec_t, yppasswdd_t, pppd_etc_t, NetworkManager_log_t, ptchown_t, vbetool_t, vdagent_t, vhostmd_t, winbind_t, sysadm_sudo_t, telnetd_t, usbmuxd_t, netlabel_mgmt_t, afs_ptserver_t, oddjob_mkhomedir_t, namespace_init_t, cyphesis_t, gnomesystemmm_t, httpd_mediawiki_script_t, kerneloops_t, varnishlog_t, configfile, httpd_w3c_validator_script_t, piranha_web_t, user_screen_t, greylist_milter_t, user_openoffice_t, httpd_user_script_t, calamaris_t, staff_openoffice_t, accountsd_t, mailman_queue_t, cgconfig_t, rpm_tmp_t, dbusd_etc_t, user_home_t, user_java_t, user_mono_t, user_wine_t, ipsec_mgmt_t, run_init_t, sendmail_t, shutdown_t, userdomain, audisp_remote_t, corosync_t, dovecot_auth_t, dlm_controld_t, gfs_controld_t, smbmount_t, asterisk_t, bitlbee_t, sepgsql_trusted_proc_t, vmware_host_t, checkpc_t, saslauthd_t, awstats_t, dhcpc_state_t, aisexec_t, rpm_var_cache_t, gitosis_t, debugfs_t, dnsmasq_t, krb5kdc_t, sysadm_seunshare_t, hotplug_t, gpg_pinentry_t, hwclock_t, newrole_t, zos_remote_t, dcc_client_t, ld_so_cache_t, mozilla_t, plymouth_t, proc_net_t, procmail_t, setrans_t, traceroute_t, pegasus_t, prelude_t, privoxy_t, staff_java_t, staff_mono_t, staff_sudo_t, staff_wine_t, wpa_cli_t, httpd_awstats_script_t, policykit_reload_t, munin_system_plugin_t, avahi_exec_t, NetworkManager_var_lib_t, NetworkManager_var_run_t, qmail_send_t, piranha_fos_t, piranha_lvs_t, sandbox_x_t, httpd_apcupsd_cgi_script_t, local_login_t, hald_dccm_t, mysqld_safe_t, ricci_modservice_t, games_srv_t, ricci_modstorage_t, samba_net_t, samba_var_t, afs_bosserver_t, httpd_nutups_cgi_script_t, hald_sonypic_t, initrc_var_run_t, boinc_project_t, nagios_mail_plugin_t, dhcpc_var_run_t, rpm_var_lib_t, fail2ban_var_lib_t, amanda_recover_t, dnsmasq_initrc_exec_t, net_conf_t, chrome_sandbox_t, httpd_munin_script_t, telepathy_salut_t, sysadm_passwd_t, sysadm_screen_t, nsplugin_t, bluetooth_helper_t, dcc_dbclean_t, nut_upsd_t, staff_execmem_t, user_execmem_t, podsleuth_t, anon_inodefs_t, qmail_remote_t, sysctl_kernel_t, policykit_t, home_cert_t, httpd_sys_script_t, staff_consolehelper_t, svc_multilog_t, ricci_modclusterd_t, user_cron_spool_t, logwatch_t, cert_type, etc_runtime_t, git_session_t, mailman_cgi_t, pulseaudio_t, mailman_mail_t, mysqlmanagerd_t, bluetooth_t, mencoder_t, named_exec_t, consoletype_exec_t, plymouthd_t, smokeping_t, ksmtuned_t, pppd_var_run_t, httpd_prewikka_script_t, ricci_modlog_t, ricci_modrpm_t, setroubleshootd_t, nsplugin_config_t, netutils_t, qmail_tcp_env_t, nagios_checkdisk_plugin_t, postfix_master_t, postfix_pickup_t, regex_milter_t, sandbox_x_client_t, abrt_var_run_t, dkim_milter_t, admin_crontab_t, hald_acl_t, consolekit_t, pam_console_t, telepathy_sunshine_t, dnsmasq_var_run_t, policykit_grant_t, logrotate_t, postfix_local_t, postfix_smtpd_t, update_modules_t, ssh_keysign_t, httpd_git_script_t, nagios_services_plugin_t, qmail_rspawn_t, uml_switch_t, qmail_inject_t, qmail_lspawn_t, courier_tcpd_t, gnomeclock_t, httpd_cvs_script_t, sandbox_net_client_t, ntpd_initrc_exec_t, NetworkManager_t, munin_mail_plugin_t, nscd_initrc_exec_t, iptables_exec_t, qmail_queue_t, sandbox_web_client_t, groupadd_t, loadkeys_t, audisp_t, auditd_t, chkpwd_t, comsat_t, dbskkd_t, dccifd_t, dirsrv_t, fenced_t, gconfd_t, groupd_t, iscsid_t, kismet_t, kpropd_t, ktalkd_t, lsassd_t, lwregd_t, mysqld_t, oddjob_t, openct_t, svc_start_t, fail2ban_t, passwd_t, qdiskd_t, smoltclient_t, racoon_t, soundd_t, telepathy_stream_engine_t, updpwd_t, prelude_lml_t, xguest_t, dmidecode_t, xm_ssh_t, ypbind_t, ypserv_t, zabbix_t, sysctl_crypto_t, abrt_t, system_dbusd_var_lib_t, acct_t, bin_t, brctl_t, cgred_t, chfn_t, ciped_t, clamd_t, modemmanager_t, clogd_t, cupsd_t, dccd_t, dhcpd_t, dictd_t, ftpd_t, gpsd_t, gssd_t, guest_t, hald_t, howl_t, hplip_t, httpd_t, innd_t, kdump_t, klogd_t, lircd_t, lpd_t, lpr_t, lwiod_t, lwsmd_t, mount_t, logfile, mpd_t, munin_t, named_t, nfsd_t, nmbd_t, nscd_t, nslcd_t, ntop_t, ntpd_t, pcscd_t, pingd_t, pppd_t, pptp_t, psad_t, httpd_rotatelogs_t, ptal_t, afs_kaserver_t, qpidd_t, policykit_auth_exec_t, radvd_t, rhgb_t, rpcd_t, rshd_t, rssh_t, munin_disk_plugin_t, sftpd_t, slapd_t, smbd_t, snmpd_t, snort_t, spamd_t, squid_t, ssh_t, sshd_t, sssd_t, staff_t, svirt_t, swat_t, tcpd_t, kdumpgui_t, tftpd_t, tgtd_t, tor_t, httpd_bugzilla_script_t, tuned_t, ulogd_t, uml_t, user_t, postfix_bounce_t, usr_t, uucpd_t, uux_t, selinux_config_t, xauth_t, ypxfr_t, httpd_smokeping_cgi_script_t, nx_server_t, eventlogd_t, policykit_auth_t, ssh_keygen_t, nagios_system_plugin_t, postfix_qmgr_t, postfix_smtp_t, prelude_audisp_t, abrt_t, piranha_pulse_t, courier_authdaemon_t, sysadm_su_t, afs_vlserver_t, hald_log_t, hald_mac_t, iptables_t, fsdaemon_t, git_shell_t, openvpn_exec_t, lib_t, cachefilesd_t, courier_sqwebmail_t, postfix_cleanup_t, munin_services_plugin_t, postfix_showq_t, jabberd_router_t, policykit_resolve_t, hostname_t, winbind_helper_t, shorewall_t, showmount_t, telepathy_gabble_t, load_policy_t, nut_upsmon_t, sssd_public_t, cupsd_config_t, hald_keymap_t, httpd_helper_t, rtkit_daemon_t, insmod_exec_t, root_t, krb5_host_rcache_t. 
Then execute: 
restorecon -v '/etc/NetworkManager/VPN/nm-vpnc-service.name'


*****  Plugin catchall (1.44 confidence) suggests  ***************************

If you believe that NetworkManager should be allowed getattr access on the nm-vpnc-service.name file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep NetworkManager /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:system_r:NetworkManager_t:s0
Target Context                system_u:object_r:unlabeled_t:s0
Target Objects                /etc/NetworkManager/VPN/nm-vpnc-service.name [
                              file ]
Source                        NetworkManager
Source Path                   /usr/sbin/NetworkManager
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           NetworkManager-0.8.4-1.fc14
Target RPM Packages           NetworkManager-vpnc-0.8.1-1.fc14
Policy RPM                    selinux-policy-3.9.7-40.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.13-92.fc14.x86_64
                              #1 SMP Sat May 21 17:26:25 UTC 2011 x86_64 x86_64
Alert Count                   2
First Seen                    Mon 20 Jun 2011 08:28:32 AM EDT
Last Seen                     Mon 20 Jun 2011 10:58:15 AM EDT
Local ID                      1852a35b-f2d3-4246-9220-f4b94494c639

Raw Audit Messages
type=AVC msg=audit(1308581895.17:25796): avc:  denied  { getattr } for  pid=2474 comm="NetworkManager" path="/etc/NetworkManager/VPN/nm-vpnc-service.name" dev=dm-0 ino=71031 scontext=unconfined_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file


type=SYSCALL msg=audit(1308581895.17:25796): arch=x86_64 syscall=fstat success=yes exit=0 a0=d a1=7fff51a06480 a2=7fff51a06480 a3=1 items=0 ppid=1 pid=2474 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm=NetworkManager exe=/usr/sbin/NetworkManager subj=unconfined_u:system_r:NetworkManager_t:s0 key=(null)

Hash: NetworkManager,NetworkManager_t,unlabeled_t,file,getattr

audit2allow

#============= NetworkManager_t ==============
allow NetworkManager_t unlabeled_t:file getattr;

audit2allow -R

#============= NetworkManager_t ==============
allow NetworkManager_t unlabeled_t:file getattr;