Hide Forgot
SELinux is preventing /bin/cp from 'relabelfrom' accesses on the file quick. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that cp should be allowed relabelfrom access on the quick file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep cp /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:prelink_cron_system_t:s0-s0:c0.c 1023 Target Context unconfined_u:object_r:prelink_var_lib_t:s0 Target Objects quick [ file ] Source cp Source Path /bin/cp Port <Unknown> Host (removed) Source RPM Packages coreutils-8.5-7.fc14 Target RPM Packages Policy RPM selinux-policy-3.9.7-31.fc14 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 2.6.35.11-83.fc14.x86_64 #1 SMP Mon Feb 7 07:06:44 UTC 2011 x86_64 x86_64 Alert Count 2 First Seen Fri 18 Mar 2011 08:49:49 PM GMT Last Seen Fri 18 Mar 2011 08:49:49 PM GMT Local ID 8628e5b4-94f4-4d8c-aaec-9af998a844ee Raw Audit Messages type=AVC msg=audit(1300481389.897:3432): avc: denied { relabelfrom } for pid=23835 comm="cp" name="quick" dev=sda6 ino=93293 scontext=system_u:system_r:prelink_cron_system_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:prelink_var_lib_t:s0 tclass=file type=SYSCALL msg=audit(1300481389.897:3432): arch=x86_64 syscall=fsetxattr success=no exit=EACCES a0=4 a1=7fff71efab70 a2=c05930 a3=2b items=0 ppid=23828 pid=23835 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=14 comm=cp exe=/bin/cp subj=system_u:system_r:prelink_cron_system_t:s0-s0:c0.c1023 key=(null) Hash: cp,prelink_cron_system_t,prelink_var_lib_t,file,relabelfrom audit2allow #============= prelink_cron_system_t ============== #!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow prelink_cron_system_t prelink_var_lib_t:file relabelfrom; audit2allow -R #============= prelink_cron_system_t ============== #!!!! This avc is a constraint violation. You will need to add an attribute to either the source or target type to make it work. #Contraint rule: allow prelink_cron_system_t prelink_var_lib_t:file relabelfrom;
This looks like you mislabeled your /var/lib directory. Please execute restorecon -R -v -F /var/lib Should fix this problem. At some point you got your cron system running as unconfined_u?
This system was installed as Fedora 14 with btrfs, and has run with SELinux enabled from that point - I have never intentionally run with SELinux disabled. No idea how cron got to run as unconfined_u; I've run the restorecon command you suggested, and if the AVC recurs, I will reopen this bug, asking for help diagnosing how cron got into the bad state.
Getting these with F15 when prelink runs: type=AVC msg=audit(1304694371.161:103): avc: denied { relabelfrom } for pid=2504 comm="cp" name="quick" dev=sdb6 ino=132792 scontext=system_u:system_r:prelink_cron_system_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:prelink_var_lib_t:s0 tclass=file This was a clean reinstall to eliminate problems caused by booting with selinux=0. [joeblow@fir lib]$ sealert -l 8d477043-3597-48d3-8760-25416f95736e | head -1 SELinux is preventing /bin/cp from relabelfrom access on the file /var/lib/prelink/quick. [joeblow@fir lib]$ ls -lZ /var/lib/prelink/quick -rw-r--r--. root root unconfined_u:object_r:prelink_var_lib_t:s0 /var/lib/prelink/quick selinux-policy-3.9.16-21.fc15.noarch selinux-policy-targeted-3.9.16-21.fc15.noarch $ sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 24 Policy from config file: targeted
The problem is the prelink_var_lib_t file was created by unconfined_u, and we are blocking on a constraint. If you ran restorecon -FR -v /var/lib/prelink This problem will go away. I have added a fix to policy to allow this which should be in selinux-policy-3.9.16-24.fc15