Summary: SELinux is preventing /usr/bin/boinc_client "open" access on nvidiactl. Detailed Description: [acemd2_6.04_x86 has a permissive type (boinc_t). This access was not denied.] SELinux denied access requested by boinc_client. It is not expected that this access is required by boinc_client and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context unconfined_u:system_r:boinc_t:s0 Target Context system_u:object_r:xserver_misc_device_t:s0 Target Objects nvidiactl [ chr_file ] Source acemd2_6.04_x86 Source Path /var/lib/boinc/projects/www.gpugrid.net/acemd2_6.0 4_x86_64-pc-linux-gnu__cuda Port <Unknown> Host (removed) Source RPM Packages boinc-client-6.10.45-1.r21128svn.fc13 Target RPM Packages Policy RPM selinux-policy-3.7.19-15.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.33.4-95.fc13.x86_64 #1 SMP Thu May 13 05:16:23 UTC 2010 x86_64 x86_64 Alert Count 3 First Seen Thu 27 May 2010 04:51:52 AM EDT Last Seen Fri 28 May 2010 12:34:16 AM EDT Local ID 541514f3-8107-4f1c-b988-13a7fd957e36 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1275021256.443:74): avc: denied { open } for pid=3694 comm="boinc_client" name="nvidiactl" dev=devtmpfs ino=17524 scontext=unconfined_u:system_r:boinc_t:s0 tcontext=system_u:object_r:xserver_misc_device_t:s0 tclass=chr_file node=(removed) type=SYSCALL msg=audit(1275021256.443:74): arch=c000003e syscall=2 success=yes exit=15 a0=7fff4cc3e590 a1=2 a2=7fff4cc3e59e a3=19 items=0 ppid=1 pid=3694 auid=500 uid=491 gid=472 euid=491 suid=491 fsuid=491 egid=472 sgid=472 fsgid=472 tty=(none) ses=1 comm="boinc_client" exe="/usr/bin/boinc_client" subj=unconfined_u:system_r:boinc_t:s0 key=(null) Hash String generated from catchall,acemd2_6.04_x86,boinc_t,xserver_misc_device_t,chr_file,open audit2allow suggests: #============= boinc_t ============== allow boinc_t xserver_misc_device_t:chr_file open;
I suspect this is very closely related to Bug 596573, but I don't know whether it's close enough to be considered the same. This alert occurs whenever the boinc-client service is restarted.
*** This bug has been marked as a duplicate of bug 596573 ***
Well this is somewhat different in the boinc client is opening the xserver_misc_device_t nvidiactl, If boinc is supposed to open the Xdevice then it should be allowed. This one does not show it as mislabeled.