Description of problem: SELinux is preventing systemd-tmpfile from using the 'sys_admin' capabilities. ***** Plugin catchall (100. confidence) suggests *************************** If si pensa che systemd-tmpfile dovrebbe avere funzionalità sys_admin in modo predefinito. Then si dovrebbe riportare il problema come bug. E' possibile generare un modulo di politica locale per consentire questo accesso. Do consentire questo accesso per il momento eseguendo: # grep systemd-tmpfile /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:systemd_tmpfiles_t:s0 Target Context system_u:system_r:systemd_tmpfiles_t:s0 Target Objects [ capability ] Source systemd-tmpfile Source Path systemd-tmpfile Port <Sconosciuto> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.12.1-63.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.9.8-300.fc19.x86_64 #1 SMP Thu Jun 27 19:24:23 UTC 2013 x86_64 x86_64 Alert Count 3 First Seen 2013-07-16 15:55:31 CEST Last Seen 2013-07-16 15:55:31 CEST Local ID 17504358-0b2d-46b3-9cd6-c32583eb03e0 Raw Audit Messages type=AVC msg=audit(1373982931.280:260): avc: denied { sys_admin } for pid=353 comm="systemd-tmpfile" capability=21 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:system_r:systemd_tmpfiles_t:s0 tclass=capability Hash: systemd-tmpfile,systemd_tmpfiles_t,systemd_tmpfiles_t,capability,sys_admin Additional info: reporter: libreport-2.1.5 hashmarkername: setroubleshoot kernel: 3.9.8-300.fc19.x86_64 type: libreport
Would be nice if we new what syscall it was attempting.
Did you stop collecting the SYSCALL record Dan? There should always be a SYSCALL record in the audit log, even if no rules are loaded. Loading rules only gives you PATHNAME records... This is the second bug without an associated SYSCALL record...
No code changes to this code in years. plioski Can you attach the output of ausearch -m avc -i
Created attachment 915737 [details] Comment (This comment was longer than 65,535 characters and has been moved to an attachment by Red Hat Bugzilla).
Why is systemd-tmpfiles going into /sys/kernel/debug/vgaswitcheroo/switch?
Description of problem: The SELinux alert simply appeared, likely due to the systemd-tmpfile service carrying out its tasks to remove old temporary files. Additional info: reporter: libreport-2.1.6 hashmarkername: setroubleshoot kernel: 3.10.5-201.fc19.x86_64 type: libreport
I am suprised to see it in those directories. /sys/kernel/debug/vgaswitcheroo/switch
Hmm, is there some tmpfiles snippet listing things in /sys/kernel/ on your machine? I.e. do you see anything in /etc/sysctl.d or /usr/lib/sysctl.d/ referencing those dirs? If so, which package is that file from?