Description of problem: chronyd has a (rarely used) feature that allows it to compensate for temperature changes. It can be configured to read a temperature sensor in /sysfs, for example /sys/class/hwmon/hwmon1/device/temp2_input, but selinux seems to block access to it. audit2allow prints: #============= chronyd_t ============== allow chronyd_t sysfs_t:file { read getattr open }; allow chronyd_t sysfs_t:lnk_file read; syslog messages: Feb 28 13:57:23 localhost kernel: [4321980.917065] type=1400 audit(1393592243.488:266): avc: denied { read } for pid=23485 comm="chronyd" name="hwmon0" dev="sysfs" ino=15502 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=lnk_file Feb 28 13:57:23 localhost kernel: [4321980.917141] type=1400 audit(1393592243.488:267): avc: denied { read } for pid=23485 comm="chronyd" name="temp2_input" dev="sysfs" ino=15515 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file Feb 28 13:57:23 localhost kernel: [4321980.917156] type=1400 audit(1393592243.488:268): avc: denied { open } for pid=23485 comm="chronyd" path="/sys/devices/platform/coretemp.0/temp2_input" dev="sysfs" ino=15515 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file Feb 28 13:57:23 localhost kernel: [4321980.917174] type=1400 audit(1393592243.488:269): avc: denied { getattr } for pid=23485 comm="chronyd" path="/sys/devices/platform/coretemp.0/temp2_input" dev="sysfs" ino=15515 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file
commit 1de94a58c8b5793c3ceea6a40238a07eeeb5da42 Author: Miroslav Grepl <mgrepl> Date: Thu Apr 10 10:49:20 2014 +0200 Allow chronyd to read /sys/class/hwmon/hwmon1/device/temp2