Red Hat Bugzilla – Bug 509275
SELinux preventing mcelog from reading /dev/urandom
Last modified: 2010-03-04 03:29:10 EST
Created attachment 350227 [details]
Output From setroubleshoot
Ever since I upgraded from Fedora 10 to Fedora 11 (via preupgrade), I have been getting setroubleshoot alerts stating that "SELinux prevented mcelog from reading the urandom device".
This hasn't really been a big problem, but it is annoying. I figure something is going wrong here, either in mcelog or in the SELinux configuration.
I don't understand why the mcelog would even need /dev/urandom. Why does a logging program need randomness?
I am attaching the output from setroubleshoot.
Miroslav, upstream rejected the current policy for mcelog saying it is different from dmesg and asked for policy written specifically for it as a cron job. Could you do that to fix this bug?
for now you can add this allow rule using
# grep avc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
The mcelog policy was added to the F12 selinux-policy.