Summary:

SELinux is preventing /usr/libexec/nm-openconnect-service "relabelto" access .

Detailed Description:

SELinux denied access requested by nm-openconnect-. It is not expected that this
access is required by nm-openconnect- and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                system_u:system_r:NetworkManager_t:s0
Target Context                system_u:system_r:NetworkManager_t:s0
Target Objects                None [ tun_socket ]
Source                        nm-openconnect-
Source Path                   /usr/libexec/nm-openconnect-service
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           NetworkManager-
                              openconnect-0.7.996-4.git20090921.fc12
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.32-106.fc12
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     (removed)
Platform                      Linux (removed) 2.6.32.10-90.fc12.x86_64 #1 SMP Tue Mar
                              23 09:47:08 UTC 2010 x86_64 x86_64
Alert Count                   15
First Seen                    Sat 03 Apr 2010 05:13:11 PM PDT
Last Seen                     Sat 03 Apr 2010 05:21:42 PM PDT
Local ID                      c7d28eb4-cb2c-4b91-b9f2-d65d44e0bd65
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1270340502.3:27732): avc:  denied  { relabelto } for  pid=12640 comm="nm-openconnect-" scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:system_r:NetworkManager_t:s0 tclass=tun_socket

node=(removed) type=SYSCALL msg=audit(1270340502.3:27732): arch=c000003e syscall=16 success=no exit=-13 a0=4 a1=400454ca a2=7fffcb00ebd0 a3=7fffcb00ebd0 items=0 ppid=1391 pid=12640 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="nm-openconnect-" exe="/usr/libexec/nm-openconnect-service" subj=system_u:system_r:NetworkManager_t:s0 key=(null)



Hash String generated from  catchall,nm-openconnect-,NetworkManager_t,NetworkManager_t,tun_socket,relabelto
audit2allow suggests:

#============= NetworkManager_t ==============
allow NetworkManager_t self:tun_socket relabelto;