I keep getting the following selinux alerts.. host=gelk type=AVC msg=audit(1209370387.669:1944098): avc: denied { getattr } for pid=5549 comm="rpc.mountd" path="/dev/oprofile" dev=oprofilefs ino=25090 scontext=unconfined_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:oprofilefs_t:s0 tclass=dir host=gelk type=SYSCALL msg=audit(1209370387.669:1944098): arch=c000003e syscall=4 success=no exit=-13 a0=7fff4549dbc0 a1=7fff4549db30 a2=7fff4549db30 a3=0 items=0 ppid=1 pid=5549 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=197568 comm="rpc.mountd" exe="/usr/sbin/rpc.mountd" subj=unconfined_u:system_r:nfsd_t:s0 key=(null) I have no idea what's causing them. They seem to happen at various times of the day, sometimes even whilst I'm asleep. Why nfsd is touching /dev/oprofile at all I've no idea. This reminds me of a similar bug I had a while back that 'went away' where the same thing was happening but that was /dev/admmidi instead.
This probably has to do with the fact thatrpc.mountd is searching for the uuid of some export. It used the routines in libblkid. The reason the other bug 'went away' is I removed a blkid call (blkid_probe_all_new()) that *always* touch every /dev entry, which was obviously not needed... So I wonder if something in the liblkid lib has changed... Dan, is there some policy that problems using this interface should be using or set?
Well this is fixed in selinux-policy-3.3.1-45.fc9.noarch