Description of problem: SELinux is preventing sh from 'write' accesses on the каталог /tmp. ***** Plugin restorecon (99.5 confidence) suggests ************************ If you want to fix the label. /tmp default label should be tmp_t. Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly. Do # /sbin/restorecon -v /tmp ***** Plugin catchall (1.49 confidence) suggests ************************** If you believe that sh should be allowed write access on the tmp directory by default. Then рекомендуется создать отчет об ошибке. Чтобы разрешить доступ, можно создать локальный модуль политики. Do allow this access for now by executing: # ausearch -c 'sh' --raw | audit2allow -M my-sh # semodule -X 300 -i my-sh.pp Additional Information: Source Context system_u:system_r:abrt_t:s0-s0:c0.c1023 Target Context system_u:object_r:tmpfs_t:s0 Target Objects /tmp [ dir ] Source sh Source Path sh Port <Неизвестно> Host (removed) Source RPM Packages Target RPM Packages filesystem-3.3-3.fc27.x86_64 Policy RPM selinux-policy-3.13.1-283.26.fc27.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.15.8-300.fc27.x86_64 #1 SMP Fri Mar 9 18:11:36 UTC 2018 x86_64 x86_64 Alert Count 4 First Seen 2018-03-14 09:08:41 MSK Last Seen 2018-03-14 09:08:44 MSK Local ID 0b1fe8db-c005-433b-913b-5338cc2f4ac2 Raw Audit Messages type=AVC msg=audit(1521007724.666:235): avc: denied { write } for pid=1699 comm="sh" name="/" dev="tmpfs" ino=25822 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir permissive=0 Hash: sh,abrt_t,tmpfs_t,dir,write Version-Release number of selected component: selinux-policy-3.13.1-283.26.fc27.noarch Additional info: component: selinux-policy reporter: libreport-2.9.3 hashmarkername: setroubleshoot kernel: 4.15.8-300.fc27.x86_64 type: libreport
***** Plugin restorecon (99.5 confidence) suggests ************************ If you want to fix the label. /tmp default label should be tmp_t. Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly. Do # /sbin/restorecon -v /tmp