Description of problem: ---- time->Mon Jul 27 09:26:23 2015 type=AVC msg=audit(1437981983.456:676): avc: denied { read } for pid=11271 comm="kexec" name="vmlinuz-4.2.0-0.rc0.git1.1.fc23.x86_64" dev="sda1" ino=20 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=file permissive=1 ---- time->Mon Jul 27 09:26:23 2015 type=AVC msg=audit(1437981983.456:677): avc: denied { open } for pid=11271 comm="kexec" path="/boot/vmlinuz-4.2.0-0.rc0.git1.1.fc23.x86_64" dev="sda1" ino=20 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=file permissive=1 ---- time->Mon Jul 27 09:26:23 2015 type=AVC msg=audit(1437981983.459:678): avc: denied { getattr } for pid=11271 comm="kexec" path="/boot/vmlinuz-4.2.0-0.rc0.git1.1.fc23.x86_64" dev="sda1" ino=20 scontext=system_u:system_r:kdump_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=file permissive=1 Version-Release number of selected component (if applicable): selinux-policy-3.13.1-138.fc24.noarch How reproducible: always Steps to Reproduce: 1. systemctl restart kdump 2. 3.
On Fedora 23 this bug is more severe because kdump cannot start even with bundled kernel. $ ls -Z /boot/vmlinuz-* system_u:object_r:boot_t:s0 /boot/vmlinuz-0-rescue-9e1725064a94497289316879f51a108f system_u:object_r:boot_t:s0 /boot/vmlinuz-4.1.7-200.fc22.x86_64 system_u:object_r:modules_object_t:s0 /boot/vmlinuz-4.2.5-300.fc23.x86_64
This bug is caused by that kernel-install didn't handle file context properly after copying bzImage. It has been fixed in http://pkgs.fedoraproject.org/cgit/systemd.git/commit/?id=d4f265678413c7656d78074af12ec7f083b50aac , but hasn't been merged into f23 branch.
*** This bug has been marked as a duplicate of bug 1244057 ***