Hide Forgot
Description of problem: Setroubleshoot sent me a report that a process in the gpg_t domain had tried to read a file with the mail_spool_t type and been denied. This happens for a user_u user. (I have __default__ mapped to user_u, and a few selected users mapped to unconfined_u in my /etc/selinux/targeted/seusers) Most likely, the user had logged in and read his mail using mutt, and mutt had tried to verify a signature in one of the mails. This seems like something that would make sense to allow. Is it intentional it is prohibited, or is it a bug that should be fixed? Version-Release number of selected component (if applicable): selinux-policy-targeted-3.10.0-38.fc16.noarch
I forgot, I should of course have included the actual AVC: type=AVC msg=audit(1317979307.260:618): avc: denied { read } for pid=10206 comm="gpg" path="/var/spool/mail/david" dev=dm-0 ino=5193737 scontext=user_u:user_r:gpg_t:s0 tcontext=system_u:object_r:mail_spool_t:s0 tclass=file type=SYSCALL msg=audit(1317979307.260:618): arch=x86_64 syscall=execve success=yes exit=0 a0=a47170 a1=a47ae0 a2=a45200 a3=7fff0c5f1210 items=0 ppid=10164 pid=10206 auid=505 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=pts2 ses=85 comm=gpg exe=/usr/bin/gpg2 subj=user_u:user_r:gpg_t:s0 key=(null)
Fixed in selinux-policy-targeted-3.10.0-39.fc16
selinux-policy-3.10.0-40.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-40.fc16
Package selinux-policy-3.10.0-40.fc16: * should fix your issue, * was pushed to the Fedora 16 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-40.fc16' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2011-14363 then log in and leave karma (feedback).
selinux-policy-3.10.0-40.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.