Description of problem: I installed sysstat yesterday because I had a use for iostat. Last night at 11:53, the sysstat cron job ran /usr/lib64/sa/sa2. At that point, I got 3 AVC denials, all identical: node=localhost.localdomain type=AVC msg=audit(1246945981.863:36711): avc: denied { read } for pid=26488 comm="find" name="mls" dev=selinuxfs ino=12 scontext=system_u:system_r:sysstat_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file node=localhost.localdomain type=SYSCALL msg=audit(1246945981.863:36711): arch=c000003e syscall=2 success=no exit=-13 a0=7fff931f6ca0 a1=0 a2=7fff931f6cac a3=fffffff8 items=0 ppid=26480 pid=26488 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=101 comm="find" exe="/bin/find" subj=system_u:system_r:sysstat_t:s0-s0:c0.c1023 key=(null) So it appears that sa2 tried to descend into /selinux and was denied. Version-Release number of selected component (if applicable): sysstat-8.0.4-7.fc11.x86_64 How reproducible: I don't know. It has only run once. But given the symptoms, I expect this to happen every time the cron job runs. Steps to Reproduce: 1. Install sysstat on a system with SELinux in enforcing mode. 2. Wait for the sysstat cron job to run at 11:53 PM. Actual results: AVC denials on /selinux. Expected results: No AVC denials. Additional info:
Hello, I don't know any reason why sysstat should read mls file. Please could you change the row: 53 23 * * * root /usr/lib/sa/sa2 -A to 53 23 * * * root strace /usr/lib/sa/sa2 -A 2>&1 | grep ^open in /etc/cron.d/sysstat and write the result here. And try to use command /usr/lib/sa/sa2 -A from command line and write the results here too.
Sorry, I've been on vacation. Looking back at the system logs, I see that I got the AVC denials the nights of July 6, 7, 8, and 9. The AVC denial has not happened since then. According to yum.log, I did not update any packages after installing sysstat on July 6 until I returned from vacation yesterday, July 27. I'm mystified why the AVC denials should stop on their own like that. I see that the statistics gathering has continued, since the timestamps on /var/log/sa/* are up to date. I don't know what to say. It looks like I can no longer reproduce the problem. Running /usr/lib64/sa/sa2 -A produces the expected files in /var/log/sa, but no AVC denial and no terminal output. <*Shrug*> If it happens again, I'll let you know.
Thanks, for now, I'm closing this bug, but if the problem appears again please reopen it and paste here the data from comment #1.