Description of problem: Attempting to contact another libvirtd instance a remote non-root user. Additional info: libreport version: 2.0.17 kernel: 3.6.3-1.fc17.x86_64 description: :SELinux is preventing /usr/libexec/polkit-1/polkit-agent-helper-1 from 'name_connect' accesses on the tcp_socket . : :***** Plugin catchall (100. confidence) suggests *************************** : :If you believe that polkit-agent-helper-1 should be allowed name_connect access on the tcp_socket by default. :Then you should report this as a bug. :You can generate a local policy module to allow this access. :Do :allow this access for now by executing: :# grep polkit-agent-he /var/log/audit/audit.log | audit2allow -M mypol :# semodule -i mypol.pp : :Additional Information: :Source Context unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c : 0.c1023 :Target Context system_u:object_r:ldap_port_t:s0 :Target Objects [ tcp_socket ] :Source polkit-agent-he :Source Path /usr/libexec/polkit-1/polkit-agent-helper-1 :Port 389 :Host (removed) :Source RPM Packages polkit-0.104-6.fc17.x86_64 :Target RPM Packages :Policy RPM selinux-policy-3.10.0-156.fc17.noarch :Selinux Enabled True :Policy Type targeted :Enforcing Mode Enforcing :Host Name (removed) :Platform Linux (removed) 3.6.3-1.fc17.x86_64 #1 SMP Mon Oct : 22 15:32:35 UTC 2012 x86_64 x86_64 :Alert Count 11 :First Seen 2012-10-25 15:18:55 EST :Last Seen 2012-10-29 13:21:59 EST :Local ID d4515920-b5f8-4850-8601-3b392c0a9e20 : :Raw Audit Messages :type=AVC msg=audit(1351480919.925:1225): avc: denied { name_connect } for pid=10330 comm="polkit-agent-he" dest=389 scontext=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket : : :type=SYSCALL msg=audit(1351480919.925:1225): arch=x86_64 syscall=connect success=no exit=EACCES a0=4 a1=19b6c70 a2=10 a3=7fff5a22a394 items=0 ppid=1487 pid=10330 auid=1111 uid=1111 gid=100 euid=0 suid=0 fsuid=0 egid=100 sgid=100 fsgid=100 tty=(none) ses=2 comm=polkit-agent-he exe=/usr/libexec/polkit-1/polkit-agent-helper-1 subj=unconfined_u:unconfined_r:policykit_auth_t:s0-s0:c0.c1023 key=(null) : :Hash: polkit-agent-he,policykit_auth_t,ldap_port_t,tcp_socket,name_connect : :audit2allow : :#============= policykit_auth_t ============== :#!!!! This avc can be allowed using one of the these booleans: :# authlogin_nsswitch_use_ldap, allow_ypbind : :allow policykit_auth_t ldap_port_t:tcp_socket name_connect; : :audit2allow -R : :#============= policykit_auth_t ============== :#!!!! This avc can be allowed using one of the these booleans: :# authlogin_nsswitch_use_ldap, allow_ypbind : :allow policykit_auth_t ldap_port_t:tcp_socket name_connect; :
Created attachment 634846 [details] File: type
Created attachment 634847 [details] File: hashmarkername
Woops, clicked too soon, didn't see this was a boolean. Sorry.