Hide Forgot
SELinux is preventing /lib/udev/udisks-part-id from 'ioctl' accesses on the blk_file /dev/sdc. ***** Plugin restorecon (90.5 confidence) suggests ************************* If you want to fix the label. /dev/sdc default label should be fixed_disk_device_t. Then you can run restorecon. Do # /sbin/restorecon -v /dev/sdc ***** Plugin device (9.50 confidence) suggests ***************************** If you want to allow udisks-part-id to have ioctl access on the sdc blk_file Then you need to change the label on /dev/sdc to a type of a similar device. Do # semanage fcontext -a -t SIMILAR_TYPE '/dev/sdc' # restorecon -v '/dev/sdc' ***** Plugin catchall (1.40 confidence) suggests *************************** If you believe that udisks-part-id should be allowed ioctl access on the sdc blk_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep udisks-part-id /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:udev_t:s0-s0:c0.c1023 Target Context system_u:object_r:device_t:s0 Target Objects /dev/sdc [ blk_file ] Source udisks-part-id Source Path /lib/udev/udisks-part-id Port <Unknown> Host (removed) Source RPM Packages udisks-1.0.2-4.fc15 Target RPM Packages Policy RPM selinux-policy-3.9.16-21.fc16 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 2.6.39-0.rc7.git0.0.fc16.x86_64 #1 SMP Tue May 10 13:14:43 UTC 2011 x86_64 x86_64 Alert Count 1 First Seen Thu 12 May 2011 09:29:35 AM CEST Last Seen Thu 12 May 2011 09:29:35 AM CEST Local ID 8b42e27a-3da7-4278-9cde-6ca8a0be2336 Raw Audit Messages type=AVC msg=audit(1305185375.296:75): avc: denied { ioctl } for pid=1687 comm="udisks-part-id" path="/dev/sdc" dev=devtmpfs ino=65107 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=blk_file type=SYSCALL msg=audit(1305185375.296:75): arch=x86_64 syscall=ioctl success=yes exit=0 a0=3 a1=80081272 a2=7fffbab4a9c0 a3=0 items=0 ppid=1073 pid=1687 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=udisks-part-id exe=/lib/udev/udisks-part-id subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null) Hash: udisks-part-id,udev_t,device_t,blk_file,ioctl audit2allow #============= udev_t ============== allow udev_t device_t:blk_file ioctl; audit2allow -R #============= udev_t ============== allow udev_t device_t:blk_file ioctl;
Hi, I'm not sure if it's clear that /dev/sdc is a removable usb stick. Martin Kho
Miroslav we should allow this.