Description of problem: policy 1.9.2-13 Logged in as sysadm_r user One of the standard things I run is gkrellm since it gives me a good quick look at what is going on. I got some denied events. Besides gkrellm, not some by nautilus and gnome-vfs-daemon During startup I get the following: Apr 6 16:16:25 hummer kernel: audit(1081282585.209:0): avc: denied { search } for pid=1766 exe=/usr/bin/gkrellm dev= ino=1 scontext=czarcing:staff_r:staff_t tcontext=system_u:object_r:sysfs_t tclass=dir Apr 6 16:16:26 hummer kernel: audit(1081282586.530:0): avc: denied { getattr } for pid=1788 exe=/usr/libexec/gnome-vfs-daemon path=/initrd dev=ram0 ino=2 scontext=czarcing:staff_r:staff_t tcontext=system_u:object_r:file_t tclass=dir Apr 6 16:16:27 hummer kernel: audit(1081282587.294:0): avc: denied { getattr } for pid=1797 exe=/usr/bin/nautilus path=/initrd dev=ram0 ino=2 scontext=czarcing:staff_r:staff_t tcontext=system_u:object_r:file_t tclass=dir Apr 6 16:16:27 hummer kernel: audit(1081282587.581:0): avc: denied { write } for pid=1764 exe=/usr/bin/nautilus name=mapping-czarcing dev=hda10 ino=32765 scontext=czarcing:staff_r:staff_t tcontext=czarcing:object_r:sysadm_tmp_t tclass=sock_file Apr 6 16:16:27 hummer kernel: audit(1081282587.581:0): avc: denied { write } for pid=1764 exe=/usr/bin/nautilus name=mapping-czarcing dev=hda10 ino=32765 scontext=czarcing:staff_r:staff_t tcontext=czarcing:object_r:sysadm_tmp_t tclass=sock_file Apr 6 16:16:28 hummer kernel: audit(1081282588.177:0): avc: denied { setattr } for pid=1766 exe=/usr/bin/gkrellm name=czarcing dev=hda10 ino=184534 scontext=czarcing:staff_r:staff_t tcontext=system_u:object_r:mail_spool_t tclass=file Apr 6 16:16:30 hummer kernel: audit(1081282590.078:0): avc: denied { lock } for pid=1766 exe=/usr/bin/gkrellm path=/var/run/utmp dev=hda10 ino=179525 scontext=czarcing:staff_r:staff_t tcontext=system_u:object_r:initrc_var_run_t tclass=file Apr 6 16:16:35 hummer kernel: audit(1081282595.027:0): avc: denied { lock } for pid=1766 exe=/usr/bin/gkrellm path=/var/run/utmp dev=hda10 ino=179525 scontext=czarcing:staff_r:staff_t tcontext=system_u:object_r:initrc_var_run_t tclass=file
Updated policy to handle some of these. /initrd should be unmounted in init scripts causes a couple of these. Also the sysadm_tmp_t looks like a bad file left over in the /tmp directory. Added to policy-1.10.1-2 Dan