Bug 853893

Description of problem:

SELinux show a AVC Denial while Anaconda is install the grub loader, and the message is:


"
SELinux is preventing /usr/sbin/setfiles from 'read, write' accesses on the chr_file /dev/mapper/control.

*****  Plugin leaks (86.2 confidence) suggests  ******************************

If you want to ignore setfiles trying to read write access the control chr_file, because you believe it should not need this access.
Then you should report this as a bug.  
You can generate a local policy module to dontaudit this access.
Do
# grep /usr/sbin/setfiles /var/log/audit/audit.log | audit2allow -D -M mypol
# semodule -i mypol.pp

*****  Plugin catchall (14.7 confidence) suggests  ***************************

If you believe that setfiles should be allowed read write access on the control chr_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep restorecon /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c102
                              3
Target Context                system_u:object_r:lvm_control_t:s0
Target Objects                /dev/mapper/control [ chr_file ]
Source                        restorecon
Source Path                   /usr/sbin/setfiles
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           policycoreutils-2.1.12-5.fc18.i686
Target RPM Packages           
Policy RPM                    selinux-policy-3.11.1-7.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              3.6.0-0.rc2.git2.1.fc18.i686 #1 SMP Wed Aug 22
                              12:22:10 UTC 2012 i686 i686
Alert Count                   1
First Seen                    2012-09-03 05:12:59 EDT
Last Seen                     2012-09-03 05:12:59 EDT
Local ID                      545a01d9-0f6b-4d0b-964f-0e2e058e2b17

Raw Audit Messages
type=AVC msg=audit(1346663579.282:323): avc:  denied  { read write } for  pid=3466 comm="restorecon" path="/dev/mapper/control" dev="devtmpfs" ino=5992 scontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file


type=SYSCALL msg=audit(1346663579.282:323): arch=i386 syscall=execve success=yes exit=0 a0=974ad10 a1=974b478 a2=974b2b0 a3=974b478 items=0 ppid=3465 pid=3466 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm=restorecon exe=/usr/sbin/setfiles subj=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 key=(null)

Hash: restorecon,setfiles_t,lvm_control_t,chr_file,read,write

audit2allow

#============= setfiles_t ==============
allow setfiles_t lvm_control_t:chr_file { read write };

audit2allow -R

#============= setfiles_t ==============
allow setfiles_t lvm_control_t:chr_file { read write };

"

Version-Release number of selected component (if applicable):

Fedora 18 Alpha TC5 Live CD KDE Spin i686
md5sum: b26a6da9d0ddbb0ed9e22212bd0f613d

How reproducible:

Always

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info: