Résumé: SELinux is preventing /usr/bin/iceauth access to a leaked unix_stream_socket file descriptor. Description détaillée: [iceauth a un type permissif (iceauth_t). Cet accès n'a pas été refusé.] SELinux denied access requested by the iceauth command. It looks like this is either a leaked descriptor or iceauth output was redirected to a file it is not allowed to access. Leaks usually can be ignored since SELinux is just closing the leak and reporting the error. The application does not use the descriptor, so it will run properly. If this is a redirection, you will not get output in the unix_stream_socket. You should generate a bugzilla on selinux-policy, and it will get routed to the appropriate package. You can safely ignore this avc. Autoriser l'accès: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Informations complémentaires: Contexte source unconfined_u:unconfined_r:iceauth_t:s0-s0:c0.c1023 Contexte cible unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Objets du contexte unix_stream_socket [ unix_stream_socket ] source iceauth Chemin de la source /usr/bin/iceauth Port <Inconnu> Hôte (removed) Paquetages RPM source xorg-x11-server-utils-7.4-13.fc12 Paquetages RPM cible Politique RPM selinux-policy-3.6.32-59.fc12 Selinux activé True Type de politique targeted Mode strict Enforcing Nom du plugin leaks Nom de l'hôte (removed) Plateforme Linux (removed) 2.6.31.6-166.fc12.i686.PAE #1 SMP Wed Dec 9 11:00:30 EST 2009 i686 athlon Compteur d'alertes 3 Première alerte mar. 22 déc. 2009 06:59:26 CET Dernière alerte mar. 22 déc. 2009 06:59:26 CET ID local dd8eaa2f-de1f-4e56-a26b-9effc3a4acfa Numéros des lignes Messages d'audit bruts node=(removed) type=AVC msg=audit(1261461566.127:16): avc: denied { read write } for pid=22801 comm="iceauth" path="socket:[15244]" dev=sockfs ino=15244 scontext=unconfined_u:unconfined_r:iceauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=(removed) type=AVC msg=audit(1261461566.127:16): avc: denied { read write } for pid=22801 comm="iceauth" path="socket:[15165]" dev=sockfs ino=15165 scontext=unconfined_u:unconfined_r:iceauth_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=(removed) type=AVC msg=audit(1261461566.127:16): avc: denied { read } for pid=22801 comm="iceauth" path="/dev/urandom" dev=tmpfs ino=2965 scontext=unconfined_u:unconfined_r:iceauth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file node=(removed) type=SYSCALL msg=audit(1261461566.127:16): arch=40000003 syscall=11 success=yes exit=0 a0=816a270 a1=8169810 a2=8168db0 a3=8169810 items=0 ppid=22800 pid=22801 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="iceauth" exe="/usr/bin/iceauth" subj=unconfined_u:unconfined_r:iceauth_t:s0-s0:c0.c1023 key=(null) Hash String generated from selinux-policy-3.6.32-59.fc12,leaks,iceauth,iceauth_t,unconfined_t,unix_stream_socket,read,write audit2allow suggests: audit2allow is not installed.
You can add these rules for now using # grep avc /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Fixed in selinux-policy-3.6.32-62.fc12.noarch
selinux-policy-3.6.32-63.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-63.fc12
selinux-policy-3.6.32-66.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-66.fc12
selinux-policy-3.6.32-66.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-0184
selinux-policy-3.6.32-63.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.
selinux-policy-3.6.32-66.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.