Description of problem: I started munin-node. SELinux is preventing /usr/bin/df from 'getattr' accesses on the directory /sys/kernel/config. ***** Plugin restorecon (99.5 confidence) suggests ************************* If sie möchten die Kennzeichnung korrigieren. /sys/kernel/config Standard-Kennzeichnung sollte sysfs_t sein. Then sie können restorecon ausführen. Do # /sbin/restorecon -v /sys/kernel/config ***** Plugin catchall (1.49 confidence) suggests *************************** If sie denken, dass df standardmässig erlaubt sein sollte, getattr Zugriff auf config directory zu erhalten. Then sie sollten dies als Fehler melden. Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen. Do zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen: # grep df /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:disk_munin_plugin_t:s0 Target Context system_u:object_r:configfs_t:s0 Target Objects /sys/kernel/config [ dir ] Source df Source Path /usr/bin/df Port <Unbekannt> Host (removed) Source RPM Packages coreutils-8.15-9.fc17.x86_64 Target RPM Packages Policy RPM selinux-policy-3.10.0-161.fc17.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.6.10-2.fc17.x86_64 #1 SMP Tue Dec 11 18:07:34 UTC 2012 x86_64 x86_64 Alert Count 2 First Seen 2012-12-15 00:38:16 CET Last Seen 2012-12-15 00:38:26 CET Local ID 00b863e2-4522-478a-9803-fcb50a1728ad Raw Audit Messages type=AVC msg=audit(1355528306.567:1121): avc: denied { getattr } for pid=9266 comm="df" path="/sys/kernel/config" dev="configfs" ino=9429 scontext=system_u:system_r:disk_munin_plugin_t:s0 tcontext=system_u:object_r:configfs_t:s0 tclass=dir type=SYSCALL msg=audit(1355528306.567:1121): arch=x86_64 syscall=stat success=no exit=EACCES a0=20cd320 a1=7fffdbb2f050 a2=7fffdbb2f050 a3=3e2e884790 items=0 ppid=9265 pid=9266 auid=4294967295 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=4294967295 comm=df exe=/usr/bin/df subj=system_u:system_r:disk_munin_plugin_t:s0 key=(null) Hash: df,disk_munin_plugin_t,configfs_t,dir,getattr audit2allow #============= disk_munin_plugin_t ============== allow disk_munin_plugin_t configfs_t:dir getattr; audit2allow -R #============= disk_munin_plugin_t ============== allow disk_munin_plugin_t configfs_t:dir getattr; Additional info: hashmarkername: setroubleshoot kernel: 3.6.10-2.fc17.x86_64 type: libreport
Added. commit b2a98000f6ef80a8744353bbe5dbedf214d28e89 Author: Miroslav Grepl <mgrepl> Date: Mon Dec 17 12:41:00 2012 +0100 Allow munin disk plugins to get attributes of all fs directories
selinux-policy-3.10.0-165.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-165.fc17
Package selinux-policy-3.10.0-165.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-165.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-20544/selinux-policy-3.10.0-165.fc17 then log in and leave karma (feedback).
Package selinux-policy-3.10.0-166.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-166.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-20544/selinux-policy-3.10.0-166.fc17 then log in and leave karma (feedback).
selinux-policy-3.10.0-166.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.