Red Hat Bugzilla – Bug 197234
depmod AVC evilness
Last modified: 2007-11-30 17:11:36 EST
Description of problem: While testing a kernel module package using the fedora kernel module packaging guidelines I had the following error installing the package: # rpm -ihv kmod-openafs-1.4.1-5.2.6.16_1.2289_FC6.i686.rpm Preparing... ########################################### [100%] 1:kmod-openafs ########################################### [100%] FATAL: Could not rename /lib/modules/2.6.16-1.2289_FC6/modules.pcimap.temp into /lib/modules/2.6.16-1.2289_FC6/modules.pcimap: Permission denied audit(1151343427.189:42): avc: denied { use } for pid=28746 comm="mcstransd" name="null" dev=tmpfs ino=4189 scontext=user_u:system_r:setrans_t:s0 tcontext=user_u:system_r:rpm_script_t:s0 tclass=fd audit(1151343427.189:43): avc: denied { use } for pid=28746 comm="mcstransd" name="null" dev=tmpfs ino=4189 scontext=user_u:system_r:setrans_t:s0 tcontext=user_u:system_r:rpm_script_t:s0 tclass=fd audit(1151594029.050:44): avc: denied { unlink } for pid=22427 comm="depmod" name="modules.dep" dev=dm-0 ino=10780850 scontext=user_u:system_r:depmod_t:s0 tcontext=user_u:object_r:modules_object_t:s0 tclass=file This is preventing depmod from working propperly. Version-Release number of selected component (if applicable): selinux-policy-targeted-2.3.1-1
The problem here is a labeling problem modules.dep should be labeled modules_dep_t not modules_object_t. restorecon -R -v /lib/modules