Detailed Description: SELinux denied access requested by ntpd. It is not expected that this access is required by ntpd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:system_r:ntpd_t:s0 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects socket [ unix_stream_socket ] Source ntpd Source Path /usr/sbin/ntpd Port <Unknown> Host david-fc10 Source RPM Packages ntp-4.2.4p6-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-44.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name david-fc10 Platform Linux david-fc10 2.6.27.12-170.2.5.fc10.i686 #1 SMP Wed Jan 21 02:09:37 EST 2009 i686 i686 Alert Count 1 First Seen Sun 15 Feb 2009 06:01:31 AM EST Last Seen Sun 15 Feb 2009 06:01:31 AM EST Local ID 054eba85-0844-4206-8323-c30b1a510c3d Line Numbers Raw Audit Messages node=david-fc10 type=AVC msg=audit(1234695691.880:33): avc: denied { read write } for pid=3087 comm="ntpd" path="socket:[15372]" dev=sockfs ino=15372 scontext=unconfined_u:system_r:ntpd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=david-fc10 type=SYSCALL msg=audit(1234695691.880:33): arch=40000003 syscall=11 success=yes exit=0 a0=87458e8 a1=8744f00 a2=8745e20 a3=0 items=0 ppid=3086 pid=3087 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="ntpd" exe="/usr/sbin/ntpd" subj=unconfined_u:system_r:ntpd_t:s0 key=(null)
This can be safely ignored, Are you using konsole for your terminal? Or were you using a graphical tool when this happened? It is most likely a leaked file descriptor, and SELinux is just complaining about it. It will be closed and ntpd was allowed to run normally.
I was using gnome-terminal within the gnome desktop. When I double-clicked the date-time on the panel I got this failure. When I ran System -> Administration -> Date/Time no errors, but my time zone change did not take. Worked the second time. All is now OK.
Let me restate. I now see that NTP consistently fails on boot (fails to sync before loading service). Checking event log shows the same error. Attempting to reconfigure NTP to prevent sync on boot also triggers same error. Since config does not change, I would say it's not not safe to ignore.
If this is failing on boot you must be getting different avcs then the ones you attached above, since there would be no unconfined_t processes running on the machine at boot. unconfined_t is a user label. Please attach the /var/log/audit/audit.log after a boot.
Is it still happening with current selinux-policy ? In this case please attach the /var/log/audit/audit.log after a boot.
I am closing in current release on this one. Reopen if you have a reproducer
I turned off enforcing when I encountered this (and other errors). I've been meaning to re-enable and answer your question, but have been busy. This resolution is fine. If it recurs, I will reopen. Thanks