Bug 715285

Summary:	avc: denied { sys_tty_config } for ... comm="sa1" ... scontext=root:system_r:sysstat_t:s0 tcontext=root:system_r:sysstat_t:s0 ...
Product:	Red Hat Enterprise Linux 5	Reporter:	Milos Malik <mmalik>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5.7	CC:	dwalsh, ksrot
Target Milestone:	rc
Target Release:	---
Hardware:	ia64
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-2.4.6-317.el5	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-02-21 05:47:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Milos Malik 2011-06-22 12:37:46 UTC

Description of problem:


Version-Release number of selected component (if applicable):
selinux-policy-2.4.6-313.el5
selinux-policy-targeted-2.4.6-313.el5

How reproducible:
sometimes

Steps to Reproduce:
* run following automated test on fresh ia64 machine where RHEL-5.7 is installed
/CoreOS/selinux-policy/Regression/bz485078-wrong-context-for-sysstat
  
Actual results:
----
time->Wed Jun 22 07:07:09 2011
type=SYSCALL msg=audit(1308740829.064:762): arch=c0000032 syscall=1065 success=yes exit=0 a0=0 a1=5401 a2=60000fffff92a940 a3=0 items=0 ppid=30638 pid=30639 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sa1" exe="/bin/bash" subj=root:system_r:sysstat_t:s0 key=(null)
type=AVC msg=audit(1308740829.064:762): avc:  denied  { sys_tty_config } for  pid=30639 comm="sa1" capability=26 scontext=root:system_r:sysstat_t:s0 tcontext=root:system_r:sysstat_t:s0 tclass=capability
----

Expected results:
no AVCs

Comment 1 Milos Malik 2011-06-22 12:47:28 UTC

http://beaker-archive.app.eng.bos.redhat.com/beaker-logs/2011/06/1005/100543/205056/2230694//TESTOUT.log

Comment 2 Daniel Walsh 2011-06-22 13:49:57 UTC

We allow this in RHEL6.

Comment 3 Miroslav Grepl 2011-09-29 11:32:16 UTC

Fixed in selinux-policy-2.4.6-317.el5

Comment 6 errata-xmlrpc 2012-02-21 05:47:02 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0158.html