Description of problem: The nightly 'argus' cron job results in an selinux avc. The line '/sbin/tmpwatch -m 366d $ARGUSPATH/archive' appears to be the cause. Please add a type enforcement (TE) allow rule in the default install of argus. SELinux is preventing /usr/sbin/tmpwatch from 'setattr' accesses on the directory /var/lib/argus/archive. ***** Plugin catchall_labels (83.8 confidence) suggests ******************* If you want to allow tmpwatch to have setattr access on the archive directory Then you need to change the label on /var/lib/argus/archive Do # semanage fcontext -a -t FILE_TYPE '/var/lib/argus/archive' where FILE_TYPE is one of the following: NetworkManager_tmp_t, abrt_tmp_t, abrt_upload_watch_tmp_t, abrt_var_cache_t, admin_crontab_tmp_t, alsa_home_t, alsa_tmp_t, amanda_tmp_t, antivirus_db_t, antivirus_home_t, antivirus_tmp_t, apcupsd_tmp_t, apmd_tmp_t, arpwatch_tmp_t, asterisk_tmp_t, audio_home_t, auditadm_sudo_tmp_t, auth_home_t, automount_tmp_t, awstats_tmp_t, bacula_tmp_t, bitlbee_tmp_t, bluetooth_helper_tmp_t, bluetooth_helper_tmpfs_t, bluetooth_tmp_t, boinc_project_tmp_t, boinc_tmp_t, bootloader_tmp_t, bugzilla_tmp_t, cache_home_t, cardmgr_dev_t, ccs_tmp_t, cdcc_tmp_t, chrome_sandbox_home_t, chrome_sandbox_tmp_t, cinder_api_tmp_t, cinder_backup_tmp_t, cinder_scheduler_tmp_t, cinder_volume_tmp_t, cloud_init_tmp_t, cluster_tmp_t, cobbler_tmp_t, cockpit_tmp_t, collectd_script_tmp_t, colord_tmp_t, comsat_tmp_t, condor_master_tmp_t, condor_schedd_tmp_t, condor_startd_tmp_t, config_home_t, conman_tmp_t, couchdb_tmp_t, crack_tmp_t, crond_tmp_t, crontab_tmp_t, ctdbd_tmp_t, cups_pdf_tmp_t, cupsd_lpd_tmp_t, cupsd_tmp_t, cvs_home_t, cvs_tmp_t, cyphesis_tmp_t, cyrus_tmp_t, data_home_t, dbadm_sudo_tmp_t, dbskkd_tmp_t, dbus_home_t, dcc_client_tmp_t, dcc_dbclean_tmp_t, dccd_tmp_t, dccifd_tmp_t, dccm_tmp_t, ddclient_tmp_t, deltacloudd_tmp_t, devicekit_tmp_t, dhcpc_tmp_t, dhcpd_tmp_t, dirsrv_tmp_t, dirsrvadmin_tmp_t, disk_munin_plugin_tmp_t, dkim_milter_tmp_t, dnssec_trigger_tmp_t, docker_home_t, docker_tmp_t, dovecot_auth_tmp_t, dovecot_deliver_tmp_t, dovecot_tmp_t, drbd_tmp_t, exim_tmp_t, fail2ban_tmp_t, fenced_tmp_t, fetchmail_home_t, firewalld_tmp_t, firewallgui_tmp_t, fsadm_tmp_t, fsdaemon_tmp_t, ftpd_tmp_t, ftpdctl_tmp_t, games_tmp_t, games_tmpfs_t, gconf_home_t, gconf_tmp_t, geoclue_tmp_t, getty_tmp_t, git_script_tmp_t, git_user_content_t, gkeyringd_gnome_home_t, gkeyringd_tmp_t, glance_registry_tmp_t, glance_tmp_t, glusterd_tmp_t, gnome_home_t, gpg_agent_tmp_t, gpg_pinentry_tmp_t, gpg_pinentry_tmpfs_t, gpg_secret_t, gpm_tmp_t, gssd_tmp_t, gstreamer_home_t, home_bin_t, home_cert_t, httpd_cache_t, httpd_php_tmp_t, httpd_suexec_tmp_t, httpd_tmp_t, httpd_user_content_t, httpd_user_htaccess_t, httpd_user_ra_content_t, httpd_user_rw_content_t, httpd_user_script_exec_t, icc_data_home_t, iceauth_home_t, inetd_child_tmp_t, inetd_tmp_t, init_tmp_t, initrc_tmp_t, ipsec_tmp_t, iptables_tmp_t, irc_home_t, irc_tmp_t, irssi_home_t, iscsi_tmp_t, kadmind_tmp_t, kdumpctl_tmp_t, kdumpgui_tmp_t, keystone_tmp_t, kismet_home_t, kismet_log_t, kismet_tmp_t, kismet_tmpfs_t, klogd_tmp_t, krb5_home_t, krb5_host_rcache_t, krb5kdc_tmp_t, ktalkd_tmp_t, l2tpd_tmp_t, ldconfig_tmp_t, livecd_tmp_t, local_login_home_t, logrotate_mail_tmp_t, logrotate_tmp_t, logwatch_mail_tmp_t, logwatch_tmp_t, lpd_tmp_t, lpr_tmp_t, lsassd_tmp_t, lsmd_plugin_tmp_t, lvm_tmp_t, mail_home_rw_t, mail_home_t, mail_munin_plugin_tmp_t, mailman_cgi_tmp_t, mailman_mail_tmp_t, mailman_queue_tmp_t, man_cache_t, man_t, mandb_cache_t, mandb_home_t, mediawiki_tmp_t, mock_tmp_t, mojomojo_tmp_t, mongod_tmp_t, mount_tmp_t, mozilla_home_t, mozilla_plugin_tmp_t, mozilla_plugin_tmpfs_t, mozilla_tmp_t, mozilla_tmpfs_t, mpd_home_t, mpd_tmp_t, mpd_user_data_t, mplayer_home_t, mplayer_tmpfs_t, mscan_tmp_t, munin_script_tmp_t, munin_tmp_t, mysqld_home_t, mysqld_tmp_t, nagios_eventhandler_plugin_tmp_t, nagios_openshift_plugin_tmp_t, nagios_system_plugin_tmp_t, nagios_tmp_t, named_tmp_t, netutils_tmp_t, neutron_tmp_t, nova_ajax_tmp_t, nova_api_tmp_t, nova_cert_tmp_t, nova_compute_tmp_t, nova_conductor_tmp_t, nova_console_tmp_t, nova_direct_tmp_t, nova_network_tmp_t, nova_objectstore_tmp_t, nova_scheduler_tmp_t, nova_vncproxy_tmp_t, nova_volume_tmp_t, ntop_tmp_t, ntpd_tmp_t, nut_upsd_tmp_t, nut_upsdrvctl_tmp_t, nut_upsmon_tmp_t, nx_server_tmp_t, openshift_cgroup_read_tmp_t, openshift_cron_tmp_t, openshift_initrc_tmp_t, openshift_tmp_t, openshift_var_lib_t, openvpn_tmp_t, openvswitch_tmp_t, openwsman_tmp_t, pam_timestamp_tmp_t, passenger_tmp_t, pcp_tmp_t, pegasus_openlmi_storage_tmp_t, pegasus_tmp_t, piranha_web_tmp_t, pkcs_slotd_tmp_t, pki_tomcat_tmp_t, podsleuth_tmp_t, podsleuth_tmpfs_t, policykit_tmp_t, polipo_cache_home_t, polipo_config_home_t, portmap_tmp_t, postfix_bounce_tmp_t, postfix_cleanup_tmp_t, postfix_local_tmp_t, postfix_map_tmp_t, postfix_pickup_tmp_t, postfix_pipe_tmp_t, postfix_qmgr_tmp_t, postfix_smtp_tmp_t, postfix_smtpd_tmp_t, postfix_virtual_tmp_t, postgresql_tmp_t, pppd_tmp_t, prelink_tmp_t, prelude_lml_tmp_t, print_spool_t, procmail_home_t, procmail_tmp_t, psad_tmp_t, pulseaudio_home_t, pulseaudio_tmpfs_t, puppet_tmp_t, puppetmaster_tmp_t, qpidd_tmp_t, racoon_tmp_t, realmd_tmp_t, rhev_agentd_tmp_t, rhsmcertd_tmp_t, ricci_tmp_t, rlogind_home_t, rlogind_tmp_t, rolekit_tmp_t, rpm_script_tmp_t, rpm_tmp_t, rpm_var_cache_t, rssh_ro_t, rssh_rw_t, rsync_tmp_t, rtas_errd_tmp_t, samba_net_tmp_t, sandbox_file_t, sblim_tmp_t, screen_home_t, secadm_sudo_tmp_t, sectool_tmp_t, selinux_munin_plugin_tmp_t, semanage_tmp_t, sendmail_tmp_t, services_munin_plugin_tmp_t, session_dbusd_tmp_t, sge_tmp_t, shorewall_tmp_t, slapd_tmp_t, smbd_tmp_t, smoltclient_tmp_t, smsd_tmp_t, snort_tmp_t, sosreport_tmp_t, soundd_tmp_t, spamc_home_t, spamc_tmp_t, spamd_tmp_t, speech-dispatcher_home_t, speech-dispatcher_tmp_t, squid_tmp_t, squirrelmail_spool_t, ssh_agent_tmp_t, ssh_home_t, ssh_keygen_tmp_t, ssh_tmpfs_t, staff_sudo_tmp_t, stapserver_tmp_t, stunnel_tmp_t, svirt_home_t, svirt_tmp_t, svnserve_tmp_t, swat_tmp_t, swift_tmp_t, sysadm_passwd_tmp_t, sysadm_sudo_tmp_t, syslogd_tmp_t, system_cronjob_tmp_t, system_dbusd_tmp_t, system_mail_tmp_t, system_munin_plugin_tmp_t, systemd_home_t, tcpd_tmp_t, telepathy_cache_home_t, telepathy_data_home_t, telepathy_gabble_cache_home_t, telepathy_gabble_tmp_t, telepathy_idle_tmp_t, telepathy_logger_cache_home_t, telepathy_logger_data_home_t, telepathy_logger_tmp_t, telepathy_mission_control_cache_home_t, telepathy_mission_control_data_home_t, telepathy_mission_control_home_t, telepathy_mission_control_tmp_t, telepathy_msn_tmp_t, telepathy_salut_tmp_t, telepathy_sofiasip_tmp_t, telepathy_stream_engine_tmp_t, telepathy_sunshine_home_t, telepathy_sunshine_tmp_t, telnetd_tmp_t, tetex_data_t, texlive_home_t, tgtd_tmp_t, thumb_home_t, thumb_tmp_t, tmp_t, tmpfs_t, tomcat_tmp_t, tuned_tmp_t, tvtime_home_t, tvtime_tmp_t, tvtime_tmpfs_t, udev_tmp_t, uml_ro_t, uml_rw_t, uml_tmp_t, uml_tmpfs_t, unconfined_munin_plugin_tmp_t, unlabeled_t, update_modules_tmp_t, user_fonts_cache_t, user_fonts_config_t, user_fonts_t, user_home_t, user_mail_tmp_t, user_tmp_t, usr_t, uucpd_tmp_t, var_spool_t, varnishd_tmp_t, virt_content_t, virt_home_t, virt_qemu_ga_tmp_t, virt_tmp_t, vmtools_tmp_t, vmware_conf_t, vmware_file_t, vmware_host_tmp_t, vmware_tmp_t, vmware_tmpfs_t, vpnc_tmp_t, w3c_validator_tmp_t, webadm_tmp_t, webalizer_tmp_t, wine_home_t, wireshark_home_t, wireshark_tmp_t, wireshark_tmpfs_t, xauth_home_t, xauth_tmp_t, xdm_home_t, xend_tmp_t, xenstored_tmp_t, xserver_tmpfs_t, ypbind_tmp_t, ypserv_tmp_t, zabbix_tmp_t, zarafa_deliver_tmp_t, zarafa_indexer_tmp_t, zarafa_server_tmp_t, zarafa_var_lib_t, zebra_tmp_t. Then execute: restorecon -v '/var/lib/argus/archive' ***** Plugin catchall (17.1 confidence) suggests ************************** If you believe that tmpwatch should be allowed setattr access on the archive directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep tmpwatch /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 Target Context system_u:object_r:var_lib_t:s0 Target Objects /var/lib/argus/archive [ dir ] Source tmpwatch Source Path /usr/sbin/tmpwatch Port <Unknown> Host (removed) Source RPM Packages tmpwatch-2.11-6.fc21.x86_64 Target RPM Packages argus-3.0.8-3.fc21.x86_64 Policy RPM selinux-policy-3.13.1-105.20.fc21.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 4.0.8-200.fc21.x86_64 #1 SMP Fri Jul 10 21:09:54 UTC 2015 x86_64 x86_64 Alert Count 2 First Seen 2015-09-25 03:46:04 CEST Last Seen 2015-09-26 03:14:03 CEST Local ID 0f0e46e6-77b0-4df7-aab8-d8a9c870733e Raw Audit Messages type=AVC msg=audit(1443230043.823:30210): avc: denied { setattr } for pid=18963 comm="tmpwatch" name="archive" dev="md0" ino=4194557 scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir permissive=1 type=SYSCALL msg=audit(1443230043.823:30210): arch=x86_64 syscall=utime success=yes exit=0 a0=4042f7 a1=7fffe7a47f50 a2=13de0 a3=8041 items=0 ppid=18957 pid=18963 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1949 comm=tmpwatch exe=/usr/sbin/tmpwatch subj=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 key=(null) Hash: tmpwatch,tmpreaper_t,var_lib_t,dir,setattr Version-Release number of selected component: selinux-policy-3.13.1-105.20.fc21.noarch Additional info: reporter: libreport-2.3.0 hashmarkername: setroubleshoot kernel: 4.0.8-200.fc21.x86_64 type: libreport
What kind of data is stored in /var/lib/argus/archive?
(In reply to Daniel Walsh from comment #1) > What kind of data is stored in /var/lib/argus/archive? I'm not sure. I don't actively use it. The package is part of the "Security Lab" group. According to the daily cron job the output of argus (/var/lib/argus/argus.out) is moved to the archive and gzipped. The problems started after the update below, which was installed here on September 24th. This update introduced the cron script, which does the daily rotation of the argus data. (Regardless of whether there is any such data, which is another bug.) https://bodhi.fedoraproject.org/updates/FEDORA-2015-15923 The cron script is a response to bugzilla bug 1219565. Best ask the maintainer...
Should the data that tmpreaper is attempting to cleanup in /var/lib/argus/archive? be stored there? Is this data massive, would it be better to store this in /run directory?
*** Bug 1269755 has been marked as a duplicate of this bug. ***
I'm honestly not sure either. Do you think fixing the aforementioned cron issue using logrotate (https://bugzilla.redhat.com/show_bug.cgi?id=1266304) would ameliorate the issue?
Description of problem: Incident happened unattended as PC was running PDFCrack (2nd day). Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.1.8-200.fc22.x86_64 type: libreport
Description of problem: This happened overnight whilst the PC was unattended (working on PDFcrack). Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.1.8-200.fc22.x86_64 type: libreport
Description of problem: Happened overnight whilst running PDFcrack. Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.1.8-200.fc22.x86_64 type: libreport
Description of problem: PC running overnight PDFcracker. Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.1.8-200.fc22.x86_64 type: libreport
Description of problem: Was reading an online newspaper in Firefox. Nothing stopped working or broke, just the alert popped up. Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.1.10-200.fc22.x86_64 type: libreport
Description of problem: Was running MSupdate this time. Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.1.10-200.fc22.x86_64 type: libreport
Description of problem: PC was unattended and downloading a file. Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.1.10-200.fc22.x86_64 type: libreport
Description of problem: Was running Firefox on XP in an Oracle Virtualbox container on a base Fedora 22 system. Nothing broke, slowed down or did anything noticeable. Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.1.10-200.fc22.x86_64 type: libreport
Description of problem: Was underneath the desk trying to fix a faulty microphone connection when this alert popped up. Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.2.3-200.fc22.x86_64 type: libreport
Description of problem: PC was unattended. Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.2.3-200.fc22.x86_64 type: libreport
Description of problem: Had just done a Yum Extender (who thinks these daft titles up?!!). PC was unattended. Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.1.10-200.fc22.x86_64 type: libreport
Description of problem: PC was unattended but doing Backup. Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.2.3-200.fc22.x86_64 type: libreport
Description of problem: Was running Virtualbox. PC was unattended. Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.2.3-200.fc22.x86_64 type: libreport
Description of problem: PC was unattended at the time. Version-Release number of selected component: selinux-policy-3.13.1-128.16.fc22.noarch Additional info: reporter: libreport-2.6.2 hashmarkername: setroubleshoot kernel: 4.2.3-200.fc22.x86_64 type: libreport
Description of problem: This second alert popped up when I clicked on the 'If you were trying to' option for the first alert. Version-Release number of selected component: selinux-policy-3.13.1-128.18.fc22.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.3-200.fc22.x86_64 type: libreport
Description of problem: Was simply reading an online newspaper using Firefox. Nothing slowed down, stopped or broke so far as I could determine. Version-Release number of selected component: selinux-policy-3.13.1-128.18.fc22.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.3-200.fc22.x86_64 type: libreport
Solved here https://bugzilla.redhat.com/show_bug.cgi?id=1266304