Bug 1079034

Is auditd running? If yes, you probably will need to turn off dontaudit rules 

# semodule -DB

re-test it and

# ausearch -m avc,user_avc -ts recent

Auditd is running:

[root@capsid ~]# ps aux | grep auditd
root      1084  0.0  0.0      0     0 ?        S    Mar21   0:01 [kauditd]
root      1312  0.0  0.0  27640   640 ?        S<sl Mar21   0:03 auditd
root     32428  0.0  0.0 103256   832 pts/1    S+   15:06   0:00 grep auditd

I ran:
# semodule -DB

which produced no output.  

When I connected to the box via ssh -X, the same problem recurred, but now messages do appear in the audit log.

I am attaching the output of 
# ausearch -m avc,user_avc -ts recent

as ausearch.log.  I have read through it, but it's still not clear to me exactly what access is being denied or why.

Created attachment 878147 [details]
Output of ausearch command after connecting via ssh -X

I believe the problem is here:
----
time->Mon Mar 24 15:09:24 2014
type=SYSCALL msg=audit(1395688164.841:79506): arch=c000003e syscall=2 success=no exit=-13 a0=7fffbefe4180 a1=c1 a2=180 a3=8 items=0 ppid=402 pid=403 auid=515 uid=515 gid=516 euid=515 suid=515 fsuid=515 egid=516 sgid=516 fsgid=516 tty=pts2 ses=1262 comm="xauth" exe="/usr/bin/xauth" subj=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1395688164.841:79506): avc:  denied  { read } for  pid=403 comm="xauth" name="gredner" dev=sdb1 ino=3227 scontext=unconfined_u:unconfined_r:xauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=lnk_file
----

It seems that your home directory is a symlink and current policy prevents xauth from reading where the symlink points to. The fix should be easy:

# cat mypolicy.te
module mypolicy 1.0;
require {
        type xauth_t;
        type user_home_dir_t;
        class lnk_file read;
}
allow xauth_t user_home_dir_t:lnk_file read;

# make -f /usr/share/selinux/devel/Makefile
Compiling targeted mypolicy module
/usr/bin/checkmodule:  loading policy configuration from tmp/mypolicy.tmp
/usr/bin/checkmodule:  policy configuration loaded
/usr/bin/checkmodule:  writing binary representation (version 10) to tmp/mypolicy.mod
Creating targeted mypolicy.pp policy package
rm tmp/mypolicy.mod.fc tmp/mypolicy.mod

# semodule -i mypolicy.pp

Now it should work in enforcing mode too.

BTW following command will return dontaudit rules to active policy:
# semodule -B

Here is another way how to do the same:

# ausearch -m avc -m user_avc -c xauth | audit2allow -M mypolicy
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i mypolicy.pp
# semodule -i mypolicy.pp
#

Now it should work in enforcing mode too.

That does fix the problem, thank you.  Sorry for the noise.

I added a fix for this in git.

62da22ed2af802ff6c070444bceb56dc4f238a50