Description of problem: when I use the NM applet to connect a dialup connecition I get the following message in /var/log/messages: Oct 16 20:31:31 porco kernel: audit(1161055891.481:36): avc: denied { write } for pid=5934 comm="pppd" name="resolv.conf" dev=dm-0 ino=10542765 scontext=syst em_u:system_r:pppd_t:s0 tcontext=user_u:object_r:pppd_etc_t:s0 tclass=file Oct 16 20:31:31 porco NET[6003]: /etc/sysconfig/network-scripts/ifup-post : upda ted /etc/resolv.conf I do not get this if I bring the connection up using ifup. The end result is that sometimes /etc/resolve.conf will not be updated properly. It looks like, instead of updating /etc/resolve/conf with the new dns server info, it updates it with the last successful connection dns info. So sometimes all host resolution doesn't work. Version-Release number of selected component (if applicable): NetworkManager-0.6.4-5.fc6 NetworkManager-gnome-0.6.4-5.fc6 NetworkManager-vpnc-0.7.0-0.cvs20060929.2.fc6 NetworkManager-openvpn-0.3.2-7.fc6 NetworkManager-glib-0.6.4-5.fc6 How reproducible: the avc failure occurs always when using NM to connect Steps to Reproduce: 1. create a dailup configuration; mine was through a bluetooth modem 2. use NM to connect to dialup 3. Actual results: avc denied message; with /etc/resolve.conf not always being update correctly. Expected results: no error Additional info:
I have the same problem, but I have more SELinux denials like: - SELinux is preventing the ppp daemon from inserting kernel modules. (3 times) - SELinux is preventing /usr/sbin/pppd (pppd_t) "write" access to resolv.conf (pppd_etc_t). - SELinux is preventing /bin/bash (NetworkManager_t) "read" access to ppp (pppd_etc_t). (2 times) - SELinux is preventing /bin/bash (NetworkManager_t) "search" access to ppp (pppd_etc_t).
The problem here is that resolv.conf has the wrong label on it? Is this /etc/resolv.conf or something somewhere else? resolv.conf should be labeled net_conf_t?
restorecon /etc/resolv.conf should fix. You can also run restorecond to maintain the file context on this file. service restorecond start.