Hi, I'm running SELinux in enforcing mode on fully updated CentOS-5 servers. selinux-policy-2.4.6-279.el5_5.1.noarch After the latest "possibly glibc" update I've seen the following AVC on several of my servers. Summary: SELinux is preventing tzdata-update (tzdata_t) "getattr" to / (fs_t). Detailed Description: SELinux denied access requested by tzdata-update. It is not expected that this access is required by tzdata-update and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context root:system_r:tzdata_t:SystemLow-SystemHigh Target Context system_u:object_r:fs_t Target Objects / [ filesystem ] Source tzdata-update Source Path <Unknown> Port <Unknown> Host remote-backup.x.y.z Source RPM Packages Target RPM Packages filesystem-2.4.0-3.el5 Policy RPM selinux-policy-2.4.6-279.el5_5.1 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name remote-backup.x.y.z Platform Linux remote-backup.x.y.z 2.6.18-194.17.1.el5 #1 SMP Wed Sep 29 12:50:31 EDT 2010 x86_64 x86_64 Alert Count 3 First Seen Fri Oct 22 06:31:14 2010 Last Seen Wed Oct 27 06:39:14 2010 Local ID ec15ac2d-b644-40fb-809a-2b3809b001e5 Line Numbers Raw Audit Messages host=remote-backup.csis.ul.ie type=AVC msg=audit(1288157954.817:16502): avc: denied { getattr } for pid=2135 comm="tzdata-update" name="/" dev=sda5 ino=2 scontext=root:system_r:tzdata_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem Regards, Tony -- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/selinux
