Resúmen:

SELinux is preventing gdm-session-wor (xdm_t) "unlink" to .dmrc (user_home_t).

Descripción Detallada:

SELinux denied access requested by gdm-session-wor. The current boolean settings
do not allow this access. If you have not setup gdm-session-wor to require this
access this may signal an intrusion attempt. If you do intend this access you
need to change the booleans on this system to allow the access.

Permitiendo Acceso:

Confined processes can be configured to to run requiring different access,
SELinux provides booleans to allow you to turn on/off access as needed. The
boolean allow_polyinstantiation is set incorrectly.
Boolean Description:
Enable polyinstantiated directory support.


Comando para Corregir:

# setsebool -P allow_polyinstantiation 1

Información Adicional:

Contexto Fuente               system_u:system_r:xdm_t:s0-s0:c0.c1023
Contexto Destino              unconfined_u:object_r:user_home_t:s0
Objetos Destino               .dmrc [ file ]
Fuente                        gdm-session-wor
Dirección de Fuente          /usr/libexec/gdm-session-worker
Puerto                        <Desconocido>
Nombre de Equipo              (removed)
Paquetes RPM Fuentes          gdm-2.26.1-10.fc11
Paquetes RPM Destinos         
RPM de Políticas             selinux-policy-3.6.12-39.fc11
SELinux Activado              True
Tipo de Política             targeted
Modo Obediente                Enforcing
Nombre de Plugin              catchall_boolean
Nombre de Equipo              (removed)
Plataforma                    Linux (removed) 2.6.29.4-167.fc11.i586 #1 SMP Wed
                              May 27 17:14:37 EDT 2009 i686 athlon
Cantidad de Alertas           1
Visto por Primera Vez         dom 15 nov 2009 22:24:13 CET
Visto por Última Vez         dom 15 nov 2009 22:24:13 CET
ID Local                      aa06b238-357b-4fb2-9ca4-2f829b25290e
Números de Línea            

Mensajes de Auditoría Crudos 

node=(removed) type=AVC msg=audit(1258320253.293:45809): avc:  denied  { unlink } for  pid=5414 comm="gdm-session-wor" name=".dmrc" dev=dm-1 ino=34720 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1258320253.293:45809): arch=40000003 syscall=38 success=no exit=-13 a0=9053d90 a1=90535f0 a2=7441a4 a3=b7f1cae8 items=0 ppid=2606 pid=5414 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4 comm="gdm-session-wor" exe="/usr/libexec/gdm-session-worker" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.6.12-39.fc11,catchall_boolean,gdm-session-wor,xdm_t,user_home_t,file,unlink
audit2allow suggests:

#============= xdm_t ==============
#!!!! This avc is allowed in the current policy

allow xdm_t user_home_t:file unlink;