There's also a ..

audit(1160090097.297:5): avc:  denied  { setexec } for  pid=3523
comm="userhelper" scontext=system_u:system_r:hald_t:s0
tcontext=system_u:system_r:hald_t:s0 tclass=process

to go with each of the { write } AVC's.

Get the latest version of hal.  It has been patched to not use userhelper to
eject  stuff (/usr/sbin/eject, instead of /usr/bin/eject.)

* Wed Oct 04 2006 David Zeuthen <davidz> - 0.5.8.1-3%{?dist}
- Fix whether some PPC boxes can suspend, fixes #208388
- Use /usr/sbin/eject rather than /usr/bin/eject, fixes #208979
- Fix a crasher in partition table probing code, should fix #206669

Dave, that sounds weird.. can you post the contents of lshal? Thanks.

(Marking this as a blocker bug for the time being. It sounds bad.)

Also... try running hald with debug information

 # service hald stop
 # /usr/sbin/hald --daemon=no --verbose=yes

and then try to reproduce it. Please paste the output when you see someone using
the Eject() method.

(btw, 'eject /' or 'eject /dev/md0' should fail as it's trying to unmount all
file systems from the block device and will only send the eject ioctl if that
succeeds. Which is won't because you got files open on the / mountpoint)

Created attachment 137978 [details]
lshal output

with todays rawhide, when I try to eject a cd in sound-juicer, it does actually
eject, with no AVC messages being generated. Hmm.

Asides from the dbus assertions, the output looks ok to me..
16:15:53.448 [I] hald_dbus.c:3885: OK for method 'Eject' with signature 'as' on
interface 'org.freedesktop.Hal.Device.Volume' for UDI
'/org/freedesktop/Hal/devices/volume_part_1_size_640571392' and execpath
'hal-storage-eject'
16:15:53.449 [I] hald_dbus.c:2940: no need to enqueue
Run started hal-storage-eject (0) (1) 
!  full path is '/usr/libexec/hal-storage-eject', program_dir is '/usr/libexec'
Warning: Error while wite r->input (
) to stdin_v.
16:15:53.481 [I] hald_dbus.c:4017: 3445: Got a connection
16:15:53.481 [I] hald_dbus.c:4018: dbus_connection_get_is_connected = 1
eject_options  = ''
processing drive's volume
/org/freedesktop/Hal/devices/volume_part_1_size_640571392 (1 of 1)
 not mounted
device                           = /dev/hdc
invoked by uid                   = 500
invoked by system bus connection = :1.17
will eject /dev/hdc
done ejecting
16:15:56.557 [I] hald_dbus.c:3968: Client to local_server was disconnected
16:15:56.557 [I] hald_dbus.c:4005: unregistered
/usr/libexec/hal-storage-eject exited
[3468]: 16:15:56.559 [D] addon-storage.c:434: Media removal detected on /dev/hdc
16:15:56.559 [I] hald_dbus.c:2964: No more methods in queue
16:15:56.559 [D] hald_dbus.c:1345:
udi=/org/freedesktop/Hal/devices/storage_model_HL_DT_ST_RW/DVD_GCC_4481B,
key=storage.removable.media_available
3468: arguments to dbus_error_is_set() were incorrect, assertion "error != NULL"
failed in file dbus-errors.c line 290.
This is normally a bug in some application using the D-Bus library.
16:15:56.561 [D] hald_dbus.c:1345:
udi=/org/freedesktop/Hal/devices/storage_model_HL_DT_ST_RW/DVD_GCC_4481B,
key=storage.partitioning_scheme
3468: arguments to dbus_error_is_set() were incorrect, assertion "error != NULL"
failed in file dbus-errors.c line 290.
This is normally a bug in some application using the D-Bus library.
16:15:56.566 [I] hald_dbus.c:2287: entering, local_interface=1
16:15:56.566 [D] hald_dbus.c:2296:
udi=/org/freedesktop/Hal/devices/storage_model_HL_DT_ST_RW/DVD_GCC_4481B
16:15:56.566 [I] blockdev.c:1318: Entering,
udi=/org/freedesktop/Hal/devices/storage_model_HL_DT_ST_RW/DVD_GCC_4481B
Run started hald-probe-storage (10000) (0) 
!  full path is '/usr/libexec/hald-probe-storage', program_dir is '/usr/libexec'
Warning: Error while wite r->input () to stdin_v.
16:15:56.571 [I] hald_dbus.c:4017: 3445: Got a connection
16:15:56.571 [I] hald_dbus.c:4018: dbus_connection_get_is_connected = 1
[3492]: 16:15:56.571 [D] probe-storage.c:153: Doing probe-storage for /dev/hdc
(bus ide) (drive_type cdrom)
(udi=/org/freedesktop/Hal/devices/storage_model_HL_DT_ST_RW/DVD_GCC_4481B)
(--only-check-for-fs==1)
[3492]: 16:15:56.571 [D] probe-storage.c:278: Checking for optical disc on /dev/hdc
[3492]: 16:15:56.571 [D] probe-storage.c:286: Doing open ("/dev/hdc", O_RDONLY |
O_NONBLOCK | O_EXCL)
16:15:56.574 [I] hald_dbus.c:1070: storage.removable.media_available -> False
/usr/libexec/hald-probe-storage exited
16:15:56.574 [I] hald_dbus.c:3968: Client to local_server was disconnected
16:15:56.574 [I] hald_dbus.c:4005: unregistered
16:15:56.574 [I] blockdev.c:1274: hald-probe-storage --only-check-for-media
returned 0 (exit_type=0)
16:15:56.574 [I] blockdev.c:1298: Media removal detected; synthesizing hotplug
rem for fakevolume /org/freedesktop/Hal/devices/volume_part_1_size_640571392
16:15:56.574 [I] hotplug.c:153: /sys/block/hdc/fakevolume is a block device (store)
16:15:56.574 [I] blockdev.c:1220: block_rem: sysfs_path=/sys/block/hdc/fakevolume
16:15:56.575 [I] blockdev.c:139: Remove callouts completed
udi=/org/freedesktop/Hal/devices/volume_part_1_size_640571392
16:15:56.575 [I] hald.c:127: Removed device from GDL;
udi=/org/freedesktop/Hal/devices/volume_part_1_size_640571392
16:16:10.613 [I] hald_dbus.c:2287: entering, local_interface=0
16:16:10.613 [D] hald_dbus.c:923: base_svc = :1.2
16:16:10.614 [I] hald_dbus.c:933: uid for caller is 500
16:16:10.614 [W] hald_dbus.c:936: uid 500 is not privileged
16:16:10.614 [W] hald_dbus.c:89: Permission denied: Rescan: not privileged
16:16:10.616 [I] hald_dbus.c:2287: entering, local_interface=0
16:16:10.616 [D] hald_dbus.c:923: base_svc = :1.2
16:16:10.617 [I] hald_dbus.c:933: uid for caller is 500
16:16:10.617 [W] hald_dbus.c:936: uid 500 is not privileged
16:16:10.617 [W] hald_dbus.c:89: Permission denied: Rescan: not privileged
16:16:10.619 [I] hald_dbus.c:2287: entering, local_interface=0
16:16:10.619 [D] hald_dbus.c:923: base_svc = :1.2
16:16:10.620 [I] hald_dbus.c:933: uid for caller is 500
16:16:10.620 [W] hald_dbus.c:936: uid 500 is not privileged
16:16:10.620 [W] hald_dbus.c:89: Permission denied: Rescan: not privileged
16:17:10.614 [I] hald_dbus.c:2287: entering, local_interface=0
16:17:10.614 [D] hald_dbus.c:923: base_svc = :1.2
16:17:10.615 [I] hald_dbus.c:933: uid for caller is 500
16:17:10.615 [W] hald_dbus.c:936: uid 500 is not privileged
16:17:10.615 [W] hald_dbus.c:89: Permission denied: Rescan: not privileged
16:17:10.617 [I] hald_dbus.c:2287: entering, local_interface=0
16:17:10.617 [D] hald_dbus.c:923: base_svc = :1.2
16:17:10.618 [I] hald_dbus.c:933: uid for caller is 500
16:17:10.618 [W] hald_dbus.c:936: uid 500 is not privileged
16:17:10.618 [W] hald_dbus.c:89: Permission denied: Rescan: not privileged
16:17:10.620 [I] hald_dbus.c:2287: entering, local_interface=0
16:17:10.620 [D] hald_dbus.c:923: base_svc = :1.2
16:17:10.621 [I] hald_dbus.c:933: uid for caller is 500
16:17:10.621 [W] hald_dbus.c:936: uid 500 is not privileged
16:17:10.621 [W] hald_dbus.c:89: Permission denied: Rescan: not privileged
16:18:10.617 [I] hald_dbus.c:2287: entering, local_interface=0
16:18:10.617 [D] hald_dbus.c:923: base_svc = :1.2
16:18:10.618 [I] hald_dbus.c:933: uid for caller is 500
16:18:10.618 [W] hald_dbus.c:936: uid 500 is not privileged
16:18:10.618 [W] hald_dbus.c:89: Permission denied: Rescan: not privileged
16:18:10.620 [I] hald_dbus.c:2287: entering, local_interface=0
16:18:10.620 [D] hald_dbus.c:923: base_svc = :1.2
16:18:10.621 [I] hald_dbus.c:933: uid for caller is 500
16:18:10.621 [W] hald_dbus.c:936: uid 500 is not privileged
16:18:10.621 [W] hald_dbus.c:89: Permission denied: Rescan: not privileged
16:18:10.623 [I] hald_dbus.c:2287: entering, local_interface=0
16:18:10.624 [D] hald_dbus.c:923: base_svc = :1.2
16:18:10.624 [I] hald_dbus.c:933: uid for caller is 500
16:18:10.624 [W] hald_dbus.c:936: uid 500 is not privileged
16:18:10.624 [W] hald_dbus.c:89: Permission denied: Rescan: not privileged