Summary: Most likely an update of mono (2.4.3.1) has introduced a couple of new SELinux alerts for podsleuth. All of them seem to be related to accessing semaphores and shared memory: 1. "read write" on /dev/shm/mono-shared-0-shared_data... (detailed report below) 2. "getattr" on /dev/shm/mono-shared-0-shared_data... 3. "unix_read unix_write" and "read write" on "None [sem]" tcontext=unconfined_u:unconfined_r:unconfined_mono_t:s0 tclass=sem SELinux is preventing /usr/bin/mono "read write" access on mono-shared-0-shared_data-(removed)-Linux-i686-312-12-0. Detailed Description: [SELinux is in permissive mode. This access was not denied.] SELinux denied access requested by mono. It is not expected that this access is required by mono and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context system_u:system_r:podsleuth_t:s0 Target Context unconfined_u:object_r:user_tmpfs_t:s0 Target Objects mono-shared-0-shared_data-(removed)- Linux-i686-312-12-0 [ file ] Source mono Source Path /usr/bin/mono Port <Unknown> Host (removed) Source RPM Packages mono-core-2.4.3.1-1.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.32-66.fc12 Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.31.9-174.fc12.i686.PAE #1 SMP Mon Dec 21 06:04:56 UTC 2009 i686 i686 Alert Count 10 First Seen Sun 17 Jan 2010 12:08:02 AM CET Last Seen Sun 17 Jan 2010 12:39:55 AM CET Local ID 8448927a-bb9f-47e7-9c93-1fe8bbaa63c3 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1263685195.806:49): avc: denied { read write } for pid=3538 comm="mono" name="mono-shared-0-shared_data-(removed)-Linux-i686-312-12-0" dev=tmpfs ino=207164 scontext=system_u:system_r:podsleuth_t:s0 tcontext=unconfined_u:object_r:user_tmpfs_t:s0 tclass=file node=(removed) type=AVC msg=audit(1263685195.806:49): avc: denied { open } for pid=3538 comm="mono" name="mono-shared-0-shared_data-(removed)-Linux-i686-312-12-0" dev=tmpfs ino=207164 scontext=system_u:system_r:podsleuth_t:s0 tcontext=unconfined_u:object_r:user_tmpfs_t:s0 tclass=file node=(removed) type=SYSCALL msg=audit(1263685195.806:49): arch=40000003 syscall=5 per=400000 success=yes exit=3 a0=bfa58970 a1=a0042 a2=1a0 a3=8fedb39 items=0 ppid=3535 pid=3538 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mono" exe="/usr/bin/mono" subj=system_u:system_r:podsleuth_t:s0 key=(null)
Thank you for filling this bug report. --- Fedora Bugzappers volunteer triage team https://fedoraproject.org/wiki/BugZappers
Miroslav can you add userdom_read_user_tmpfs_files(podsleuth_t)
Fixed in selinux-policy-3.6.32-72.fc12.noarch
selinux-policy-3.6.32-73.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-73.fc12
selinux-policy-3.6.32-73.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-0858
selinux-policy-3.6.32-73.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.