1) Infinite Loop of these messages when using "/sbin/ifup eth0" as non-root user. This is allowed when enforcement is disabled. CTRL-C is abled to stop the looping.I am not sure how you set this up to work. I execute /sbin/ifup eth0 and I get
Apr 5 21:07:28 ibmlaptop kernel: audit(1081235248.571:0): avc: denied { setuid } for pid=2463 exe=/bin/bash capability=7 scontext=user_u:user_r:user_t tcontext=user_u:user_r:user_t tclass=capability
Apr 5 21:07:28 ibmlaptop kernel: audit(1081235248.589:0): avc: denied { setuid } for pid=2463 exe=/usr/sbin/usernetctl capability=7 scontext=user_u:user_r:user_t tcontext=user_u:user_r:user_t tclass=capability
Users cannot control this device.
/etc/sysconfig/network-scripts/ifcfg-eth0 must contain
USERCTL=yes
2) "su -" from my non-root user caused this error. I was however allowed to work as root.This should be fixed in latest policy 1.9.2-12
Apr 5 21:07:42 ibmlaptop su(pam_unix)[12399]: session opened for user root by warren(uid=500)
Apr 5 21:07:42 ibmlaptop su[12399]: pam_xauth: error creating temporary file `/root/.xauthsDAz4e': Permission denied
Apr 5 21:07:42 ibmlaptop kernel: audit(1081235262.772:0): avc: denied { write } for pid=12399 exe=/bin/su name=root dev=hda2 ino=1291809 scontext=user_u:user_r:user_su_t tcontext=root:object_r:staff_home_dir_t tclass=dir
policy-1.9.2-12
I relabeled after upgrading to this version immediately before the above denied errors happened.
3) Then as root, I used "ifup eth0" which succeeded, but with the following in /var/log/messages.Added policy to allow this , but not sure what it is trying todo. Could you try it in non-enforcing mode and grab the avc messages.
Apr 5 21:07:45 ibmlaptop kernel: audit(1081235265.089:0): avc: denied { search } for pid=12493 exe=/sbin/dhclient name=lib dev=hda2 ino=1389922 scontext=root:system_r:dhcpc_t tcontext=system_u:object_r:home_root_t tclass=dir
Apr 5 21:07:45 ibmlaptop kernel: audit(1081235265.089:0): avc: denied { search } for pid=12493 exe=/sbin/dhclient name=lib dev=hda2 ino=1389922 scontext=root:system_r:dhcpc_t tcontext=system_u:object_r:home_root_t tclass=dir
Apr 5 21:07:45 ibmlaptop dhclient: can't create /var/lib/dhcp/dhclient-eth0.leases: Permission denied
Apr 5 21:07:46 ibmlaptop dhclient: sit0: unknown hardware address type 776
Apr 5 21:07:48 ibmlaptop dhclient: DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 4
Apr 5 21:07:48 ibmlaptop dhclient: DHCPOFFER from 172.31.16.1
Apr 5 21:07:48 ibmlaptop dhclient: DHCPREQUEST on eth0 to 255.255.255.255 port 67
Apr 5 21:07:48 ibmlaptop dhclient: DHCPACK from 172.31.16.1
Apr 5 21:07:48 ibmlaptop dhclient: can't create /var/lib/dhcp/dhclient-eth0.leases: Permission denied
Apr 5 21:07:48 ibmlaptop dhclient: bound to 172.31.16.101 -- renewal in 356918 seconds.
Apr 5 21:07:48 ibmlaptop kernel: audit(1081235268.039:0): avc: denied { search } for pid=12493 exe=/sbin/dhclient name=lib dev=hda2 ino=1389922 scontext=root:system_r:dhcpc_t tcontext=system_u:object_r:home_root_t tclass=dir
Apr 6 12:49:06 ibmlaptop kernel: audit(1081291746.752:0): avc: denied { search } for pid=14826 exe=/sbin/dhclient name=lib dev=hda2 ino=1389922 scontext=root:system_r:dhcpc_t tcontext=system_u:object_r:home_root_t tclass=dir
Apr 6 12:49:06 ibmlaptop kernel: audit(1081291746.919:0): avc: denied { getattr } for pid=14837 exe=/bin/gawk path=/dev/pts/6 dev= ino=8 scontext=root:system_r:dhcpc_t tcontext=root:object_r:sysadm_devpts_t tclass=chr_file
Apr 6 12:49:10 ibmlaptop dhclient: DHCPREQUEST on eth0 to 255.255.255.255 port 67
Apr 6 12:49:10 ibmlaptop dhclient: DHCPACK from 172.31.16.1
Apr 6 12:49:10 ibmlaptop dhclient: bound to 172.31.16.101 -- renewal in 379377 seconds.
