Bug 502190

Description of problem:
Got the following in syslog after updating to dmraid-1.0.0.rc13-45.el5:

# sealert -l 6281ed61-5765-4149-bbf7-9a08d6c5db52

Summary:

SELinux is preventing perl (logwatch_t) "write" to ./services (etc_t).

Detailed Description:

SELinux is preventing perl (logwatch_t) "write" to ./services (etc_t). The
SELinux type etc_t, is a generic type for all files in the directory and very
few processes (SELinux Domains) are allowed to write to this SELinux type. This
type of denial usual indicates a mislabeled file. By default a file created in a
directory has the gets the context of the parent directory, but SELinux policy
has rules about the creation of directories, that say if a process running in
one SELinux Domain (D1) creates a file in a directory with a particular SELinux
File Context (F1) the file gets a different File Context (F2). The policy
usually allows the SELinux Domain (D1) the ability to write, unlink, and append
on (F2). But if for some reason a file (./services) was created with the wrong
context, this domain will be denied. The usual solution to this problem is to
reset the file context on the target file, restorecon -v './services'. If the
file context does not change from etc_t, then this is probably a bug in policy.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against the selinux-policy package. If it does change, you can try your
application again to see if it works. The file context could have been
mislabeled by editing the file or moving the file from a different directory, if
the file keeps getting mislabeled, check the init scripts to see if they are
doing something to mislabel the file.

Allowing Access:

You can attempt to fix file context by executing restorecon -v './services'

The following command will allow this access:

restorecon './services'

Additional Information:

Source Context                system_u:system_r:logwatch_t:SystemLow-SystemHigh
Target Context                system_u:object_r:etc_t
Target Objects                ./services [ dir ]
Source                        perl
Source Path                   /usr/bin/perl
Port                          <Unknown>
Host                          dyno.devel.redhat.com
Source RPM Packages           perl-5.8.8-24.el5
Target RPM Packages           
Policy RPM                    selinux-policy-2.4.6-236.el5
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   mislabeled_file
Host Name                     dyno.devel.redhat.com
Platform                      Linux dyno.devel.redhat.com 2.6.18-150.el5 #1 SMP
                              Wed May 20 20:25:53 EDT 2009 x86_64 x86_64
Alert Count                   1
First Seen                    Fri May 22 07:24:38 2009
Last Seen                     Fri May 22 07:24:38 2009
Local ID                      6281ed61-5765-4149-bbf7-9a08d6c5db52
Line Numbers                  

Raw Audit Messages            

host=dyno.devel.redhat.com type=AVC msg=audit(1242991478.645:225): avc:  denied  { write } for  pid=5773 comm="perl" name="services" dev=dm-3 ino=3273683 scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=dir

host=dyno.devel.redhat.com type=SYSCALL msg=audit(1242991478.645:225): arch=c000003e syscall=2 success=no exit=-13 a0=1a9af930 a1=241 a2=1b6 a3=31da0f38f0 items=0 ppid=5770 pid=5773 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="perl" exe="/usr/bin/perl" subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 key=(null)

Version-Release number of selected component (if applicable):
dmraid-1.0.0.rc13-45.el5.x86_64

How reproducible:
I suspect tomorrow morning it will happen again!

Additional info:
selinux-policy and logrotate haven't changed in weeks plus.  dmraid changed yesterday and furthermore, the dmraid files are the only contents of the /etc/logwatch/*/services directories so I'm guessing this is related to the dmraid changes (bug 481749.)