Description of problem: I see this message in the journal, and once today I saw a notification for it in GNOME which lastest only very briefly even though I didn't dismiss the message. Version-Release number of selected component (if applicable): selinux-policy-3.13.1-191.5.fc24.noarch How reproducible: Frequently, I have several of these from the past couple days, but I'm not exactly sure what's triggering it. Steps to Reproduce: 1. Unknown Actual results: type=AVC msg=audit(1469306689.434:87): avc: denied { mounton } for pid=785 comm="(uetoothd)" path="/etc" dev="sda5" ino=267 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0 Expected results: Either no denial, or Additional info: Could be related to bug 1341753. comm=uetoothd in the AVC but sealert as well as the journal information on this event says the source is coredump.
Created attachment 1183239 [details] sealert output
OK so it looks like there's a bluetooth issue: Jul 23 14:44:49 f24m bluetoothd[785]: Failed to obtain handles for "Service Changed" characteristic And abrt wants to capture some info about it, and wants to create some directory, which then results in the AVC. Jul 23 14:44:52 f24m abrt-dump-journal-oops[882]: abrt-dump-journal-oops: Found oopses: 1 Jul 23 14:44:52 f24m abrt-dump-journal-oops[882]: abrt-dump-journal-oops: Creating problem directories Jul 23 14:44:52 f24m setroubleshoot[908]: SELinux is preventing (coredump) from mounton access on the directory /etc. For complete SELinux messages. run sealert -l 3fe792d7-2dc0-4379-9386-00ff207e4291
Ever since I installed the package "powetop" I have begun to see this notification from the SELinux Troubleshooter on every boot. Perhaps this is related? See below: SELinux is preventing (uetoothd) from mounton access on the directory /etc. ***** Plugin catchall_labels (83.8 confidence) suggests ******************* If you want to allow (uetoothd) to have mounton access on the etc directory Then you need to change the label on /etc Do # semanage fcontext -a -t FILE_TYPE '/etc' where FILE_TYPE is one of the following: admin_home_t, anon_inodefs_t, audit_spool_t, auditd_log_t, autofs_t, automount_tmp_t, bacula_store_t, binfmt_misc_fs_t, boot_t, capifs_t, cephfs_t, cgroup_t, cifs_t, container_image_t, debugfs_t, default_t, device_t, devpts_t, dnssec_t, dosfs_t, ecryptfs_t, efivarfs_t, fusefs_t, home_root_t, hugetlbfs_t, ifconfig_var_run_t, init_var_run_t, initrc_tmp_t, iso9660_t, kdbusfs_t, mail_spool_t, mnt_t, mqueue_spool_t, named_conf_t, news_spool_t, nfs_t, nfsd_fs_t, onload_fs_t, openshift_tmp_t, openshift_var_lib_t, oracleasmfs_t, proc_t, proc_xen_t, pstore_t, public_content_rw_t, public_content_t, ramfs_t, random_seed_t, removable_t, root_t, rpc_pipefs_t, security_t, spufs_t, src_t, svirt_sandbox_file_t, sysctl_fs_t, sysctl_t, sysfs_t, sysv_t, tmp_t, tmpfs_t, usbfs_t, user_home_dir_t, user_home_t, user_tmp_t, usr_t, var_lib_nfs_t, var_lib_t, var_lock_t, var_log_t, var_run_t, var_t, virt_image_t, virt_var_lib_t, vmblock_t, vxfs_t, xend_var_lib_t, xend_var_run_t, xenfs_t, xenstored_var_lib_t. Then execute: restorecon -v '/etc' ***** Plugin catchall (17.1 confidence) suggests ************************** If you believe that (uetoothd) should be allowed mounton access on the etc directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c '(uetoothd)' --raw | audit2allow -M my-uetoothd # semodule -X 300 -i my-uetoothd.pp Additional Information: Source Context system_u:system_r:init_t:s0 Target Context system_u:object_r:etc_t:s0 Target Objects /etc [ dir ] Source (uetoothd) Source Path (uetoothd) Port <Unknown> Host vishnu Source RPM Packages Target RPM Packages filesystem-3.2-37.fc24.x86_64 Policy RPM selinux-policy-3.13.1-191.5.fc24.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name vishnu Platform Linux vishnu 4.6.4-301.fc24.x86_64 #1 SMP Tue Jul 12 11:50:00 UTC 2016 x86_64 x86_64 Alert Count 15 First Seen 2016-07-20 00:19:27 MDT Last Seen 2016-07-24 00:47:44 MDT Local ID b8381d75-0b93-4365-a11f-912f364c00cd Raw Audit Messages type=AVC msg=audit(1469342864.699:208): avc: denied { mounton } for pid=1604 comm="(uetoothd)" path="/etc" dev="dm-0" ino=1703937 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0 Hash: (uetoothd),init_t,etc_t,dir,mounton
Apologies for the typo. The above comment should specify a package named "powertop"
I see this too. Since I am (an unskilled) developer, this pops up everytime I manage to coredump. This is although I have set Storage=none in /etc/systemd/coredump.conf . (Btw, the idea that in the default configuration all my precious passwords are floating around in /var/*/coredump gives me nightmares...)
selinux-policy-3.13.1-191.10.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-2c8a3e08c6
selinux-policy-3.13.1-191.10.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
I have updated my system and also installed the testing update of the "selinux-policy.noarch" package. The problem appears to be solved. I will, of course, report back if anything changes in that regard.