Description of problem:

Current SELinux policy apparently blocks abrtd from starting up


Version-Release number of selected component (if applicable):


3.7.19-80

How reproducible:

Always


Steps to Reproduce:
1. Start abrtd demon

  
Actual results:

abrtd fails to start and SE alert is generated


Expected results:

abrtd starts with no interruptions

Additional info:


Feb  3 15:32:41 fedora abrtd: Can't create lock file '/var/spool/abrt/kerneloops-1296743561-11939-2.lock': Permission denied
Feb  3 15:32:41 fedora setroubleshoot: SELinux is preventing /usr/sbin/abrtd from create access on the lnk_file kerneloops-1296743561-11939-2.lock. For complete SELinux messages. run sealert -l 5cbdd0c7-f3d0-4a01-a2d3-78175c0d551d

SE report:

SELinux is preventing /usr/sbin/abrtd from create access on the lnk_file kerneloops-1296743561-11939-2.lock.

Additional Information:
Source Context                unconfined_u:system_r:abrt_t:s0-s0:c0.c1023
Target Context                unconfined_u:object_r:var_spool_t:s0
Target Objects                kerneloops-1296743561-11939-2.lock [ lnk_file ]
Source                        abrtd
Source Path                   /usr/sbin/abrtd
Port                          <Unknown>
Host                          fedora.vm
Source RPM Packages           abrt-1.1.14-1.fc13
Target RPM Packages           
Policy RPM                    selinux-policy-3.7.19-80.fc13
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     fedora.vm
Platform                      Linux fedora.vm 2.6.34.7-66.fc13.i686.PAE #1 SMP
                              Wed Dec 15 07:21:49 UTC 2010 i686 i686
Alert Count                   1
First Seen                    Thu 03 Feb 2011 03:32:41 PM CET
Last Seen                     Thu 03 Feb 2011 03:32:41 PM CET
Local ID                      5cbdd0c7-f3d0-4a01-a2d3-78175c0d551d

Raw Audit Messages
type=AVC msg=audit(1296743561.186:194): avc:  denied  { create } for  pid=11939 comm="abrtd" name="kerneloops-1296743561-11939-2.lock" scontext=unconfined_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_spool_t:s0 tclass=lnk_file


type=SYSCALL msg=audit(1296743561.186:194): arch=i386 syscall=symlink success=no exit=EACCES a0=bfa6946e a1=868731c a2=78ac458 a3=bfa6945e items=0 ppid=11938 pid=11939 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=15 comm=abrtd exe=/usr/sbin/abrtd subj=unconfined_u:system_r:abrt_t:s0-s0:c0.c1023 key=(null)

Hash: abrtd,abrt_t,var_spool_t,lnk_file,create

audit2allow

#============= abrt_t ==============
allow abrt_t var_spool_t:lnk_file create;

audit2allow -R

#============= abrt_t ==============
allow abrt_t var_spool_t:lnk_file create;