Description of problem:

First seen with Fedora-Xfce-Live-i386-24_Beta-1.3.iso after launching Anaconda.


Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-182.fc24.noarch

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:
SELinux is preventing systemd from getattr access on the unix_stream_socket unix_stream_socket.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that systemd should be allowed getattr access on the unix_stream_socket unix_stream_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c systemd --raw | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:init_t:s0
Target Context                system_u:system_r:kernel_t:s0
Target Objects                unix_stream_socket [ unix_stream_socket ]
Source                        systemd
Source Path                   systemd
Port                          <Unknown>
Host                          localhost
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-182.fc24.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain 4.5.2-302.fc24.i686 #1
                              SMP Wed Apr 27 14:54:19 UTC 2016 i686 i686
Alert Count                   2
First Seen                    2016-04-29 20:12:15 EDT
Last Seen                     2016-04-29 20:12:34 EDT
Local ID                      aacaaefc-2b2b-4f78-bc02-43122c662ab4

Raw Audit Messages
type=AVC msg=audit(1461975154.714:405): avc:  denied  { getattr } for  pid=1 comm="systemd" path="socket:[152002]" dev="sockfs" ino=152002 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=unix_stream_socket permissive=1


Hash: systemd,init_t,kernel_t,unix_stream_socket,getattr


Expected results:


Additional info:

There are actually five AVC's found by ausearch -m AVC which happen in the course of running the installer.

time->Fri Apr 29 20:12:15 2016
type=AVC msg=audit(1461975135.303:398): avc:  denied  { getattr } for  pid=1 comm="systemd" path="socket:[151656]" dev="sockfs" ino=151656 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=unix_stream_socket permissive=1
----
time->Fri Apr 29 20:12:20 2016
type=AVC msg=audit(1461975140.047:403): avc:  denied  { getattr } for  pid=1 comm="systemd" path="socket:[152463]" dev="sockfs" ino=152463 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:kernel_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1
----
time->Fri Apr 29 20:12:34 2016
type=AVC msg=audit(1461975154.714:405): avc:  denied  { getattr } for  pid=1 comm="systemd" path="socket:[152002]" dev="sockfs" ino=152002 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=unix_stream_socket permissive=1
----
time->Fri Apr 29 20:15:08 2016
type=AVC msg=audit(1461975308.152:408): avc:  denied  { getattr } for  pid=1 comm="systemd" path="socket:[152608]" dev="sockfs" ino=152608 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:kernel_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1
----
time->Fri Apr 29 20:23:06 2016
type=AVC msg=audit(1461975786.117:433): avc:  denied  { getattr } for  pid=1 comm="systemd" path="socket:[184254]" dev="sockfs" ino=184254 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:kernel_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1