Résumé:

SELinux is preventing /usr/bin/gpg-agent access to a leaked /bin/sh file
descriptor.

Description détaillée:

SELinux denied access requested by the gpg-agent command. It looks like this is
either a leaked descriptor or gpg-agent output was redirected to a file it is
not allowed to access. Leaks usually can be ignored since SELinux is just
closing the leak and reporting the error. The application does not use the
descriptor, so it will run properly. If this is a redirection, you will not get
output in the /bin/sh. You should generate a bugzilla on selinux-policy, and it
will get routed to the appropriate package. You can safely ignore this avc.

Autoriser l'accès:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385)

Informations complémentaires:

Contexte source               staff_u:staff_r:gpg_agent_t:s0-s0:c0.c1023
Contexte cible                system_u:object_r:bin_t:s0
Objets du contexte            /bin/sh [ lnk_file ]
source                        gpg-agent
Chemin de la source           /usr/bin/gpg-agent
Port                          <Inconnu>
Hôte                         (removed)
Paquetages RPM source         gnupg2-2.0.13-1.fc12
Paquetages RPM cible          bash-4.0.35-3.fc12
Politique RPM                 selinux-policy-3.6.32-108.fc12
Selinux activé               True
Type de politique             targeted
Mode strict                   Enforcing
Nom du plugin                 leaks
Nom de l'hôte                (removed)
Plateforme                    Linux (removed)
                              2.6.32.10-90.fc12.x86_64 #1 SMP Tue Mar 23
                              09:47:08 UTC 2010 x86_64 x86_64
Compteur d'alertes            1
Première alerte              sam 10 avr 2010 22:39:44 EDT
Dernière alerte              sam 10 avr 2010 22:39:44 EDT
ID local                      129c11b2-ce4b-4c30-960a-b93540d87d59
Numéros des lignes           

Messages d'audit bruts        

node=(removed) type=AVC msg=audit(1270953584.538:834): avc:  denied  { read } for  pid=14203 comm="gpg-agent" name="sh" dev=dm-2 ino=135502 scontext=staff_u:staff_r:gpg_agent_t:s0-s0:c0.c1023 tcontext=system_u:object_r:bin_t:s0 tclass=lnk_file

node=(removed) type=SYSCALL msg=audit(1270953584.538:834): arch=c000003e syscall=59 success=no exit=-13 a0=e513a0 a1=7fff9e3c2990 a2=7fff9e3c35c0 a3=3174e800a0 items=0 ppid=14200 pid=14203 auid=500 uid=500 gid=501 euid=500 suid=500 fsuid=500 egid=501 sgid=501 fsgid=501 tty=(none) ses=13 comm="gpg-agent" exe="/usr/bin/gpg-agent" subj=staff_u:staff_r:gpg_agent_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  leaks,gpg-agent,gpg_agent_t,bin_t,lnk_file,read
audit2allow suggests:

#============= gpg_agent_t ==============
allow gpg_agent_t bin_t:lnk_file read;