Description of problem: left machine running overnight and came back to it SELinux is preventing /usr/bin/abrt-dump-oops from 'unlink' accesses on the file kernel. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that abrt-dump-oops should be allowed unlink access on the kernel file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep abrt-dump-oops /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:abrt_dump_oops_t:s0 Target Context system_u:object_r:initrc_tmp_t:s0 Target Objects kernel [ file ] Source abrt-dump-oops Source Path /usr/bin/abrt-dump-oops Port <Unknown> Host (removed) Source RPM Packages abrt-addon-kerneloops-2.1.4-3.fc18.x86_64 Target RPM Packages Policy RPM selinux-policy-3.11.1-97.fc18.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 3.9.5-201.fc18.x86_64 #1 SMP Tue Jun 11 19:40:51 UTC 2013 x86_64 x86_64 Alert Count 1 First Seen 2013-06-25 06:51:51 BST Last Seen 2013-06-25 06:51:51 BST Local ID c2b0b12b-a65b-4dcb-980d-dd265d3004c3 Raw Audit Messages type=AVC msg=audit(1372139511.632:872): avc: denied { unlink } for pid=3549 comm="abrt-dump-oops" name="kernel" dev="dm-2" ino=662649 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file type=SYSCALL msg=audit(1372139511.632:872): arch=x86_64 syscall=unlink success=yes exit=0 a0=703bc0 a1=702bc0 a2=15 a3=6 items=0 ppid=767 pid=3549 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=abrt-dump-oops exe=/usr/bin/abrt-dump-oops subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) Hash: abrt-dump-oops,abrt_dump_oops_t,initrc_tmp_t,file,unlink audit2allow #============= abrt_dump_oops_t ============== allow abrt_dump_oops_t initrc_tmp_t:file unlink; audit2allow -R require { type initrc_tmp_t; type abrt_dump_oops_t; class file unlink; } #============= abrt_dump_oops_t ============== allow abrt_dump_oops_t initrc_tmp_t:file unlink; Additional info: reporter: libreport-2.1.4 hashmarkername: setroubleshoot kernel: 3.9.5-201.fc18.x86_64 type: libreport
Please execute in your terminal # restorecon -R -v /var/tmp/abrt