Bug 874109

Description of problem:
Not exactly sure. I think tmpwatch just ended up running via cron.daily. It looks like systemd is putting some stuff in /tmp and changing the selinux label on it. It seems like tmpwatch ought to either skip those files or be allowed to deal with them.

OTOH, maybe systemd ought to be putting these things elsewhere? No idea what the right fix is...


Additional info:
libreport version: 2.0.18
kernel:         3.6.5-2.fc18.x86_64

description:
:SELinux is preventing /usr/sbin/tmpwatch from 'setattr' accesses on the directory systemd-namespace-xLYhDn.
:
:*****  Plugin file (36.8 confidence) suggests  *******************************
:
:If you think this is caused by a badly mislabeled machine.
:Then you need to fully relabel.
:Do
:touch /.autorelabel; reboot
:
:*****  Plugin file (36.8 confidence) suggests  *******************************
:
:If you think this is caused by a badly mislabeled machine.
:Then you need to fully relabel.
:Do
:touch /.autorelabel; reboot
:
:*****  Plugin catchall_labels (23.2 confidence) suggests  ********************
:
:If you want to allow tmpwatch to have setattr access on the systemd-namespace-xLYhDn directory
:Then you need to change the label on systemd-namespace-xLYhDn
:Do
:# semanage fcontext -a -t FILE_TYPE 'systemd-namespace-xLYhDn'
:where FILE_TYPE is one of the following: sandbox_file_t, kismet_log_t, rpm_var_cache_t, httpd_cache_t, user_home_type, print_spool_t, amavis_spool_t, man_t, usr_t, mandb_cache_t, tmpfile. 
:Then execute: 
:restorecon -v 'systemd-namespace-xLYhDn'
:
:
:*****  Plugin catchall (5.04 confidence) suggests  ***************************
:
:If you believe that tmpwatch should be allowed setattr access on the systemd-namespace-xLYhDn directory by default.
:Then you should report this as a bug.
:You can generate a local policy module to allow this access.
:Do
:allow this access for now by executing:
:# grep tmpwatch /var/log/audit/audit.log | audit2allow -M mypol
:# semodule -i mypol.pp
:
:Additional Information:
:Source Context                system_u:system_r:tmpreaper_t:s0-s0:c0.c1023
:Target Context                system_u:object_r:file_t:s0
:Target Objects                systemd-namespace-xLYhDn [ dir ]
:Source                        tmpwatch
:Source Path                   /usr/sbin/tmpwatch
:Port                          <Unknown>
:Host                          (removed)
:Source RPM Packages           tmpwatch-2.11-2.fc18.x86_64
:Target RPM Packages           
:Policy RPM                    selinux-policy-3.11.1-46.fc18.noarch
:Selinux Enabled               True
:Policy Type                   targeted
:Enforcing Mode                Enforcing
:Host Name                     (removed)
:Platform                      Linux (removed) 3.6.5-2.fc18.x86_64 #1 SMP Thu Nov
:                              1 00:39:17 UTC 2012 x86_64 x86_64
:Alert Count                   2
:First Seen                    2012-11-07 06:31:12 EST
:Last Seen                     2012-11-07 06:31:12 EST
:Local ID                      ed76975e-7f1c-4df7-91ee-61549169130c
:
:Raw Audit Messages
:type=AVC msg=audit(1352287872.867:170): avc:  denied  { setattr } for  pid=5825 comm="tmpwatch" name="systemd-namespace-xLYhDn" dev="dm-2" ino=8429762 scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=dir
:
:
:type=SYSCALL msg=audit(1352287872.867:170): arch=x86_64 syscall=utime success=no exit=EACCES a0=404923 a1=7fff3b2b8820 a2=1f1 a3=35727b1798 items=0 ppid=5823 pid=5825 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=6 comm=tmpwatch exe=/usr/sbin/tmpwatch subj=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 key=(null)
:
:Hash: tmpwatch,tmpreaper_t,file_t,dir,setattr
:
:audit2allow
:
:#============= tmpreaper_t ==============
:allow tmpreaper_t file_t:dir setattr;
:
:audit2allow -R
:
:#============= tmpreaper_t ==============
:allow tmpreaper_t file_t:dir setattr;
:


Potential duplicate bug: 826010