Description of problem: SELinux is preventing systemd-readahe from 'rename' accesses on the file .readahead.new. ***** Plugin catchall_labels (83.8 confidence) suggests ******************** If you want to allow systemd-readahe to have rename access on the .readahead.new file Then you need to change the label on .readahead.new Do # semanage fcontext -a -t FILE_TYPE '.readahead.new' where FILE_TYPE is one of the following: etc_runtime_t, readahead_var_lib_t, readahead_var_run_t. Then execute: restorecon -v '.readahead.new' ***** Plugin catchall (17.1 confidence) suggests *************************** If you believe that systemd-readahe should be allowed rename access on the .readahead.new file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep systemd-readahe /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:readahead_t:s0 Target Context system_u:object_r:mnt_t:s0 Target Objects .readahead.new [ file ] Source systemd-readahe Source Path systemd-readahe Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.12.1-57.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 3.9.8-300.fc19.x86_64 #1 SMP Thu Jun 27 19:24:23 UTC 2013 x86_64 x86_64 Alert Count 2 First Seen 2013-07-05 09:59:04 PDT Last Seen 2013-07-05 13:04:42 PDT Local ID c828e0d9-2e85-463d-a128-f9cf509bfbef Raw Audit Messages type=AVC msg=audit(1373054682.266:431): avc: denied { rename } for pid=181 comm="systemd-readahe" name=".readahead.new" dev="sda3" ino=17 scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=file Hash: systemd-readahe,readahead_t,mnt_t,file,rename Additional info: reporter: libreport-2.1.5 hashmarkername: setroubleshoot kernel: 3.9.8-300.fc19.x86_64 type: libreport
Where is ".readahead.new" located?
(In reply to Miroslav Grepl from comment #1) > Where is ".readahead.new" located? on a partition that was wiped out a long time ago.