Description of problem: SELinux is preventing rhsmcertd-worke from 'open' accesses on the file /var/log/hawkey.log. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that rhsmcertd-worke should be allowed open access on the hawkey.log file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'rhsmcertd-worke' --raw | audit2allow -M my-rhsmcertdworke # semodule -X 300 -i my-rhsmcertdworke.pp Additional Information: Source Context system_u:system_r:rhsmcertd_t:s0 Target Context unconfined_u:object_r:var_log_t:s0 Target Objects /var/log/hawkey.log [ file ] Source rhsmcertd-worke Source Path rhsmcertd-worke Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages dnf-data-4.2.8-2.fc30.noarch Policy RPM selinux-policy-3.14.3-46.fc30.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 5.2.9-200.fc30.x86_64 #1 SMP Fri Aug 16 21:37:45 UTC 2019 x86_64 x86_64 Alert Count 671 First Seen 2019-06-18 17:53:36 WEST Last Seen 2019-10-11 13:07:53 WEST Local ID 9bbe558d-cb00-49c0-8432-22b8306d4e41 Raw Audit Messages type=AVC msg=audit(1570795673.985:139951): avc: denied { open } for pid=21366 comm="rhsmcertd-worke" path="/var/log/hawkey.log" dev="dm-4" ino=266274 scontext=system_u:system_r:rhsmcertd_t:s0 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=file permissive=0 Hash: rhsmcertd-worke,rhsmcertd_t,var_log_t,file,open Version-Release number of selected component: selinux-policy-3.14.3-46.fc30.noarch Additional info: component: selinux-policy reporter: libreport-2.10.1 hashmarkername: setroubleshoot kernel: 5.2.9-200.fc30.x86_64 type: libreport
commit 002416bb7d454181fb0c93b8e39cd80a5c6fec95 (HEAD -> f30, origin/f30) Author: Lukas Vrabec <lvrabec> Date: Mon Aug 26 15:50:25 2019 +0200 Label /var/log/hawkey.log as rpm_log_t and update rpm named filetrans interfaces.
FEDORA-2019-d68c9e27f8 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-d68c9e27f8
selinux-policy-3.14.3-50.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-d68c9e27f8
FEDORA-2019-f83217e2bf has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-f83217e2bf
selinux-policy-3.14.3-51.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-f83217e2bf
FEDORA-2019-70d80ad4bc has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-70d80ad4bc
selinux-policy-3.14.3-52.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-70d80ad4bc
selinux-policy-3.14.3-52.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report.