This service will be undergoing maintenance at 03:30 UTC, 2016-05-27. It is expected to last about 2 hours
Bug 495010 - SELinux is preventing /sbin/restorecon (restorecon_t) "read" to inotify (inotifyfs_t).
SELinux is preventing /sbin/restorecon (restorecon_t) "read" to inotify (inot...
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy (Show other bugs)
5.1
i686 Linux
low Severity medium
: rc
: ---
Assigned To: Daniel Walsh
BaseOS QE
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-04-08 23:24 EDT by Dave Masters
Modified: 2012-10-15 10:01 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-09-02 04:00:08 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Dave Masters 2009-04-08 23:24:32 EDT
Description of problem:

Summary
    SELinux is preventing /sbin/restorecon (restorecon_t) "read" to inotify
    (inotifyfs_t).

Detailed Description
    SELinux denied access requested by /sbin/restorecon. It is not expected that
    this access is required by /sbin/restorecon and this access may signal an
    intrusion attempt. It is also possible that the specific version or
    configuration of the application is causing it to require additional access.

Allowing Access
    Sometimes labeling problems can cause SELinux denials.  You could try to
    restore the default system file context for inotify, restorecon -v inotify
    If this does not work, there is currently no automatic way to allow this
    access. Instead,  you can generate a local policy module to allow this
    access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you
    can disable SELinux protection altogether. Disabling SELinux protection is
    not recommended. Please file a
    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.

Additional Information        

Source Context                root:system_r:restorecon_t:SystemLow-SystemHigh
Target Context                system_u:object_r:inotifyfs_t
Target Objects                inotify [ dir ]
Affected RPM Packages         policycoreutils-1.33.12-12.el5 [application]
Policy RPM                    selinux-policy-2.4.6-104.el5
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Permissive
Plugin Name                   plugins.catchall_file
Host Name                     grins.emoti.com
Platform                      Linux grins.emoti.com 2.6.18-53.el5PAE #1 SMP Wed
                              Oct 10 16:48:18 EDT 2007 i686 athlon
Alert Count                   1
Line Numbers                  

Raw Audit Messages            

avc: denied { read } for comm="restorecon" dev=inotifyfs egid=0 euid=0
exe="/sbin/restorecon" exit=0 fsgid=0 fsuid=0 gid=0 items=0 path="inotify"
pid=3791 scontext=root:system_r:restorecon_t:s0-s0:c0.c1023 sgid=0
subj=root:system_r:restorecon_t:s0-s0:c0.c1023 suid=0 tclass=dir
tcontext=system_u:object_r:inotifyfs_t:s0 tty=pts2 uid=0



Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:

I really don't recall for certain.  I believe I may have been attempting to 
write out a bind configuration change using system-config-bind.
  
Actual results:


Expected results:


Additional info:
Comment 1 Daniel Walsh 2009-04-09 09:40:47 EDT
Can be safely ignored.

You can add these rules for now using

# grep avc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Fixed in selinux-policy-2.4.6-223.el5
Comment 8 errata-xmlrpc 2009-09-02 04:00:08 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2009-1242.html

Note You need to log in before you can comment on or make changes to this bug.