SELinux is preventing /bin/bash from getattr access on the file /bin/systemctl. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that bash should be allowed getattr access on the systemctl file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep dhclient-script /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:system_r:dhcpc_t:s0 Target Context system_u:object_r:systemd_systemctl_exec_t:s0 Target Objects /bin/systemctl [ file ] Source dhclient-script Source Path /bin/bash Port <Unknown> Host kimba Source RPM Packages bash-4.2.8-2.fc15 Target RPM Packages systemd-units-24-1.fc15 Policy RPM selinux-policy-3.9.16-15.fc15 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name kimba Platform Linux kimba 2.6.32.26-175.fc12.i686 #1 SMP Wed Dec 1 21:52:04 UTC 2010 i686 i686 Alert Count 1 First Seen Fri 22 Apr 2011 12:37:52 AM PDT Last Seen Fri 22 Apr 2011 12:37:52 AM PDT Local ID e0944a29-4c8c-416a-83c5-f83f6ef96a4f Raw Audit Messages type=AVC msg=audit(1303457872.816:5770): avc: denied { getattr } for pid=29905 comm="dhclient-script" path="/bin/systemctl" dev=sda2 ino=11386 scontext=unconfined_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file type=SYSCALL msg=audit(1303457872.816:5770): arch=i386 syscall=stat64 success=no exit=EACCES a0=96bde88 a1=bfb84250 a2=fd0ff4 a3=96bde88 items=0 ppid=10809 pid=29905 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm=dhclient-script exe=/bin/bash subj=unconfined_u:system_r:dhcpc_t:s0 key=(null) Hash: dhclient-script,dhcpc_t,systemd_systemctl_exec_t,file,getattr audit2allow #============= dhcpc_t ============== allow dhcpc_t systemd_systemctl_exec_t:file getattr; audit2allow -R #============= dhcpc_t ============== allow dhcpc_t systemd_systemctl_exec_t:file getattr;
Fixed in selinux-policy-3.9.16-17.fc15
selinux-policy-3.9.16-18.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/selinux-policy-3.9.16-18.fc15
Package selinux-policy-3.9.16-18.fc15: * should fix your issue, * was pushed to the Fedora 15 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.9.16-18.fc15' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/selinux-policy-3.9.16-18.fc15 then log in and leave karma (feedback).
selinux-policy-3.9.16-18.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report.
Thanks for the fast work. The new patches are installed on all servers and I have seen no further errors.