Bug 691665

AVCs mentioned aboved appear in enforcing mode.

Following AVCs appear when I repeat the same procedure in permissive mode:
----
time->Tue Mar 29 10:24:49 2011
type=SYSCALL msg=audit(1301387089.543:126): arch=40000003 syscall=21 success=no exit=-1 a0=836a318 a1=836a2b0 a2=836ad50 a3=6 items=0 ppid=1 pid=3299 auid=505 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none) ses=2 comm="gvfs-fuse-daemo" exe="/usr/libexec/gvfs-fuse-daemon" subj=unconfined_u:unconfined_r:sandbox_x_client_t:s0:c351,c461 key=(null)
type=AVC msg=audit(1301387089.543:126): avc:  denied  { mounton } for  pid=3299 comm="gvfs-fuse-daemo" path="/home/tulpas/.gvfs" dev=dm-0 ino=80111 scontext=unconfined_u:unconfined_r:sandbox_x_client_t:s0:c351,c461 tcontext=unconfined_u:object_r:sandbox_file_t:s0:c351,c461 tclass=dir
----
time->Tue Mar 29 10:24:55 2011
type=USER_AVC msg=audit(1301387095.282:127): user pid=1293 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.DBus.Properties member=GetAll dest=org.freedesktop.UDisks spid=3308 tpid=2285 scontext=unconfined_u:unconfined_r:sandbox_x_client_t:s0:c351,c461 tcontext=system_u:system_r:devicekit_disk_t:s0-s0:c0.c1023 tclass=dbus : exe="/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
----
time->Tue Mar 29 10:24:55 2011
type=SYSCALL msg=audit(1301387095.318:128): arch=40000003 syscall=196 success=yes exit=0 a0=bffdad4c a1=bffdac98 a2=297ff4 a3=bffd8c63 items=0 ppid=3307 pid=3308 auid=505 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none) ses=2 comm="gvfs-gdu-volume" exe="/usr/libexec/gvfs-gdu-volume-monitor" subj=unconfined_u:unconfined_r:sandbox_x_client_t:s0:c351,c461 key=(null)
type=AVC msg=audit(1301387095.318:128): avc:  denied  { getattr } for  pid=3308 comm="gvfs-gdu-volume" path="/dev/dm-0" dev=devtmpfs ino=6015 scontext=unconfined_u:unconfined_r:sandbox_x_client_t:s0:c351,c461 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file
----

I think this is a similar situation which we have with confined users. If you switch to permissive mode, you will see a lot of AVC messages.

I would dontaudit AVC msgs from enforcing mode.

Miroslav lets add

files_dontaudit_list_all_mountpoints(sandbox_x_domain)

Fixed in selinux-policy-3.7.19-81.el6

I have not seen that but Miroslav please add

optional_policy(`
	devicekit_dontaudit_dbus_chat_disk(sandbox_x_domain)
')

########################################
## <summary>
##	Dontaudit Send and receive messages from
##	devicekit disk over dbus.
## </summary>
## <param name="domain">
##	<summary>
##	Domain to not audit.
##	</summary>
## </param>
#
interface(`devicekit_dontaudit_dbus_chat_disk',`
	gen_require(`
		type devicekit_disk_t;
		class dbus send_msg;
	')

	dontaudit $1 devicekit_disk_t:dbus send_msg;
	dontaudit devicekit_disk_t $1:dbus send_msg;
')

Yes, I missed this also.

Fixed in selinux-policy-3.7.19-84.el6

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0526.html