Summary:

SELinux is preventing /usr/libexec/hald-probe-volume "ioctl" access to device
/dev/dm-15. I was mounting an encrypted LUKS partition from an external disk using GNOME (nautilus).

Detailed Description:

[SELinux is in permissive mode. This access was not denied.]

SELinux has denied hald-probe-volu "ioctl" access to device /dev/dm-15.
/dev/dm-15 is mislabeled, this device has the default label of the /dev
directory, which should not happen. All Character and/or Block Devices should
have a label. You can attempt to change the label of the file using restorecon
-v '/dev/dm-15'. If this device remains labeled device_t, then this is a bug in
SELinux policy. Please file a bg report. If you look at the other similar
devices labels, ls -lZ /dev/SIMILAR, and find a type that would work for
/dev/dm-15, you can use chcon -t SIMILAR_TYPE '/dev/dm-15', If this fixes the
problem, you can make this permanent by executing semanage fcontext -a -t
SIMILAR_TYPE '/dev/dm-15' If the restorecon changes the context, this indicates
that the application that created the device, created it without using SELinux
APIs. If you can figure out which application created the device, please file a
bug report against this application.

Allowing Access:

Attempt restorecon -v '/dev/dm-15' or chcon -t SIMILAR_TYPE '/dev/dm-15'

Additional Information:

Source Context                system_u:system_r:hald_t:s0
Target Context                system_u:object_r:device_t:s0
Target Objects                /dev/dm-15 [ blk_file ]
Source                        hald-probe-volu
Source Path                   /usr/libexec/hald-probe-volume
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           hal-0.5.13-9.fc12
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.32-106.fc12
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Plugin Name                   device
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.32.10-90.fc12.x86_64 #1 SMP Tue Mar 23
                              09:47:08 UTC 2010 x86_64 x86_64
Alert Count                   1
First Seen                    Wed 31 Mar 2010 02:07:59 AM EEST
Last Seen                     Wed 31 Mar 2010 02:07:59 AM EEST
Local ID                      fc9ca3e7-84d3-4273-b1a6-52922dae8afb
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1269990479.62:75): avc:  denied  { ioctl } for  pid=6792 comm="hald-probe-volu" path="/dev/dm-15" dev=devtmpfs ino=92651 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=blk_file

node=(removed) type=SYSCALL msg=audit(1269990479.62:75): arch=c000003e syscall=16 success=yes exit=0 a0=4 a1=1268 a2=7fffb0dc0e08 a3=7fffb0dc0ac0 items=0 ppid=2077 pid=6792 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="hald-probe-volu" exe="/usr/libexec/hald-probe-volume" subj=system_u:system_r:hald_t:s0 key=(null)



Hash String generated from  device,hald-probe-volu,hald_t,device_t,blk_file,ioctl
audit2allow suggests:

#============= hald_t ==============
allow hald_t device_t:blk_file ioctl;