Re: yum/bootloader avcs?

[Daniel J Walsh <dwalsh@xxxxxxxxxx>]

Tom London wrote:

> Running strict, latest Rawhide.
>
> I happened to do today's updates in permissive
> mode, and got the following avcs:
>
> Dec  7 07:40:23 fedora kernel: loop: loaded (max 8 devices)
> Dec  7 07:41:29 fedora kernel: audit(1102434089.867:0): avc:  denied 
> { read } for  pid=3863 exe=/bin/bash name=.bashrc dev=hda2 ino=1130588
> scontext=root:sysadm_r:bootloader_t
> tcontext=root:object_r:staff_home_t tclass=file
> Dec  7 07:41:29 fedora kernel: audit(1102434089.867:0): avc:  denied 
> { getattr } for  pid=3863 exe=/bin/bash path=/root/.bashrc dev=hda2
> ino=1130588 scontext=root:sysadm_r:bootloader_t
> tcontext=root:object_r:staff_home_t tclass=file
> Dec  7 07:41:29 fedora kernel: audit(1102434089.957:0): avc:  denied 
> { read } for  pid=3865 exe=/usr/bin/id name=config dev=hda2
> ino=4509759 scontext=root:sysadm_r:bootloader_t
> tcontext=system_u:object_r:selinux_config_t tclass=file
> Dec  7 07:41:29 fedora kernel: audit(1102434089.957:0): avc:  denied 
> { getattr } for  pid=3865 exe=/usr/bin/id path=/etc/selinux/config
> dev=hda2 ino=4509759 scontext=root:sysadm_r:bootloader_t
> tcontext=system_u:object_r:selinux_config_t tclass=file
>
> The first two of these (ref to /root/.basrc, I believe) is not new, but
> I don't remember seeing the others.  
>
> tom
>
>  
The others are there only because you are running in permissive mode.
Basically there is a dontaudit in the polic on searches of 
/etc/selinux/config, but since you
are in permissive mode it allows you to continue and read the selinux 
files, this would not happen in
strict mode.  So these are false error messages :^(