flood of selinux avcs, settroubleshoot all over the place(sorry for all the avcs)

[Antonio Olivares]

Dear all,

Here are all the selinux errors that I have encountered.
I apologize for putting in all at the same time, but I am just overwhelmed at the amount. 
I guess setroubleshoot daemon got happy and started sending all the avcs encountered.  

Thank you for advice given in advance.  

Regards,

Antonio 



Summary:

SELinux is preventing gvfsd-trash (staff_t) "dac_override" to <Unknown>
(staff_t).

Detailed Description:

SELinux denied access requested by gvfsd-trash. It is not expected that this
access is required by gvfsd-trash and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                root:staff_r:staff_t:SystemLow-SystemHigh
Target Context                root:staff_r:staff_t:SystemLow-SystemHigh
Target Objects                None [ capability ]
Source                        pulseaudio
Source Path                   /usr/bin/pulseaudio
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           gvfs-0.2.3-1.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-29.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
                              11:33:46 EDT 2008 i686 i686
Alert Count                   39
First Seen                    Wed 09 Apr 2008 07:03:20 PM CDT
Last Seen                     Wed 09 Apr 2008 07:03:45 PM CDT
Local ID                      d2fbeab2-c5e1-4968-a58a-3897ade13c01
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207785825.117:127): avc:  denied  {
dac_override } for  pid=5405 comm="gvfsd-trash" capability=1
scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023
tclass=capability

host=localhost.localdomain type=AVC msg=audit(1207785825.117:127): avc:  denied  {
dac_read_search } for  pid=5405 comm="gvfsd-trash" capability=2
scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023
tclass=capability

host=localhost.localdomain type=SYSCALL msg=audit(1207785825.117:127): arch=40000003
syscall=196 success=no exit=-13 a0=86652e8 a1=b741b1e0 a2=d14ff4 a3=0 items=0 ppid=5404
pid=5405 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5
comm="gvfsd-trash" exe="/usr/libexec/gvfsd-trash"
subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)



Summary:

SELinux is preventing escd (staff_t) "read write" to
./636F6F6C6B6579706B313173452D47617465203020302D30 (auth_cache_t).

Detailed Description:

SELinux denied access requested by escd. It is not expected that this access is
required by escd and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for
./636F6F6C6B6579706B313173452D47617465203020302D30,

restorecon -v './636F6F6C6B6579706B313173452D47617465203020302D30'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                root:staff_r:staff_t:SystemLow-SystemHigh
Target Context                system_u:object_r:auth_cache_t
Target Objects                ./636F6F6C6B6579706B313173452D47617465203020302D30
                              [ file ]
Source                        escd
Source Path                   /usr/lib/esc-1.0.1/escd
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           esc-1.0.1-9.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-29.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
                              11:33:46 EDT 2008 i686 i686
Alert Count                   1
First Seen                    Wed 09 Apr 2008 07:03:22 PM CDT
Last Seen                     Wed 09 Apr 2008 07:03:22 PM CDT
Local ID                      6cd2e4ee-4e7e-4112-adcc-b3705916d481
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207785802.447:91): avc:  denied  { read
write } for  pid=5282 comm="escd"
name=636F6F6C6B6579706B313173452D47617465203020302D30 dev=dm-0 ino=2485540
scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:auth_cache_t:s0
tclass=file

host=localhost.localdomain type=SYSCALL msg=audit(1207785802.447:91): arch=40000003
syscall=5 success=no exit=-13 a0=8a45540 a1=20002 a2=180 a3=0 items=0 ppid=1 pid=5282
auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5
comm="escd" exe="/usr/lib/esc-1.0.1/escd"
subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)



Summary:

SELinux is preventing pulseaudio (staff_t) "ipc_lock" to <Unknown>
(staff_t).

Detailed Description:

SELinux denied access requested by pulseaudio. It is not expected that this
access is required by pulseaudio and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                root:staff_r:staff_t:SystemLow-SystemHigh
Target Context                root:staff_r:staff_t:SystemLow-SystemHigh
Target Objects                None [ capability ]
Source                        gnome-keyring-d
Source Path                   /usr/bin/gnome-keyring-daemon
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           pulseaudio-0.9.10-1.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-29.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
                              11:33:46 EDT 2008 i686 i686
Alert Count                   15
First Seen                    Wed 09 Apr 2008 07:03:06 PM CDT
Last Seen                     Wed 09 Apr 2008 07:03:21 PM CDT
Local ID                      638ce06f-cd52-41b7-8f87-c3296b7b9c4e
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207785801.262:89): avc:  denied  { ipc_lock
} for  pid=5217 comm="pulseaudio" capability=14
scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023
tclass=capability

host=localhost.localdomain type=SYSCALL msg=audit(1207785801.262:89): arch=40000003
syscall=150 success=yes exit=0 a0=b6804000 a1=3c84 a2=195cb4 a3=3c84 items=0 ppid=5214
pid=5217 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5
comm="pulseaudio" exe="/usr/bin/pulseaudio"
subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)



Summary:

SELinux is preventing gvfs-fuse-daemo (staff_t) "sys_admin" to <Unknown>
(staff_t).

Detailed Description:

SELinux denied access requested by gvfs-fuse-daemo. It is not expected that this
access is required by gvfs-fuse-daemo and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                root:staff_r:staff_t:SystemLow-SystemHigh
Target Context                root:staff_r:staff_t:SystemLow-SystemHigh
Target Objects                None [ capability ]
Source                        gvfs-fuse-daemo
Source Path                   /usr/libexec/gvfs-fuse-daemon
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           gvfs-fuse-0.2.3-1.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-29.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
                              11:33:46 EDT 2008 i686 i686
Alert Count                   1
First Seen                    Wed 09 Apr 2008 07:03:21 PM CDT
Last Seen                     Wed 09 Apr 2008 07:03:21 PM CDT
Local ID                      f714cec5-eca8-4de6-a60b-d07f6e690250
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207785801.751:90): avc:  denied  {
sys_admin } for  pid=5256 comm="gvfs-fuse-daemo" capability=21
scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023
tclass=capability

host=localhost.localdomain type=SYSCALL msg=audit(1207785801.751:90): arch=40000003
syscall=21 success=no exit=-1 a0=90654d0 a1=9064940 a2=9065510 a3=6 items=0 ppid=1
pid=5256 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5
comm="gvfs-fuse-daemo" exe="/usr/libexec/gvfs-fuse-daemon"
subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)



Summary:

SELinux is preventing firefox (staff_t) "setuid" to <Unknown> (staff_t).

Detailed Description:

SELinux denied access requested by firefox. It is not expected that this access
is required by firefox and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                root:staff_r:staff_t:SystemLow-SystemHigh
Target Context                root:staff_r:staff_t:SystemLow-SystemHigh
Target Objects                None [ capability ]
Source                        firefox
Source Path                   /usr/lib/firefox-3.0b5/firefox
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           firefox-3.0-0.53.beta5.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-29.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
                              11:33:46 EDT 2008 i686 i686
Alert Count                   14
First Seen                    Wed 09 Apr 2008 07:04:12 PM CDT
Last Seen                     Wed 09 Apr 2008 07:04:12 PM CDT
Local ID                      728a632a-191d-449d-b1a1-aa9cff7a16f1
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207785852.141:144): avc:  denied  { setuid
} for  pid=5422 comm="firefox" capability=7
scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023
tclass=capability

host=localhost.localdomain type=SYSCALL msg=audit(1207785852.141:144): arch=40000003
syscall=208 success=yes exit=0 a0=ffffffff a1=0 a2=ffffffff a3=bfee4c1c items=0 ppid=5408
pid=5422 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5
comm="firefox" exe="/usr/lib/firefox-3.0b5/firefox"
subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)




Summary:

SELinux is preventing firefox (staff_t) "write" to ./firefox-3.0b5 (lib_t).

Detailed Description:

SELinux denied access requested by firefox. It is not expected that this access
is required by firefox and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./firefox-3.0b5,

restorecon -v './firefox-3.0b5'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                root:staff_r:staff_t:SystemLow-SystemHigh
Target Context                system_u:object_r:lib_t
Target Objects                ./firefox-3.0b5 [ dir ]
Source                        firefox
Source Path                   /usr/lib/firefox-3.0b5/firefox
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           firefox-3.0-0.53.beta5.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-29.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
                              11:33:46 EDT 2008 i686 i686
Alert Count                   1
First Seen                    Wed 09 Apr 2008 07:03:48 PM CDT
Last Seen                     Wed 09 Apr 2008 07:03:52 PM CDT
Local ID                      ba8ecec3-9fce-4945-92ed-d9640d5a0ea7
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207785832.379:129): avc:  denied  { write }
for  pid=5422 comm="firefox" name="firefox-3.0b5" dev=dm-0 ino=4287001
scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0
tclass=dir

host=localhost.localdomain type=SYSCALL msg=audit(1207785832.379:129): arch=40000003
syscall=5 success=no exit=-13 a0=85ec4f0 a1=82c1 a2=1a4 a3=82c1 items=0 ppid=5408 pid=5422
auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5
comm="firefox" exe="/usr/lib/firefox-3.0b5/firefox"
subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)




Summary:

SELinux is preventing pulseaudio (staff_t) "sys_resource" to <Unknown>
(staff_t).

Detailed Description:

SELinux denied access requested by pulseaudio. It is not expected that this
access is required by pulseaudio and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                root:staff_r:staff_t:SystemLow-SystemHigh
Target Context                root:staff_r:staff_t:SystemLow-SystemHigh
Target Objects                None [ capability ]
Source                        pulseaudio
Source Path                   /usr/bin/pulseaudio
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           pulseaudio-0.9.10-1.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-29.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
                              11:33:46 EDT 2008 i686 i686
Alert Count                   2
First Seen                    Wed 09 Apr 2008 07:03:20 PM CDT
Last Seen                     Wed 09 Apr 2008 07:03:20 PM CDT
Local ID                      40e0b7ff-cb5f-42de-8f1d-8302ea0c173f
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207785800.594:72): avc:  denied  {
sys_resource } for  pid=5217 comm="pulseaudio" capability=24
scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=root:staff_r:staff_t:s0-s0:c0.c1023
tclass=capability

host=localhost.localdomain type=SYSCALL msg=audit(1207785800.594:72): arch=40000003
syscall=75 success=no exit=-1 a0=e a1=bfa8cd1c a2=d14ff4 a3=e items=0 ppid=5214 pid=5217
auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5
comm="pulseaudio" exe="/usr/bin/pulseaudio"
subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)



Summary:

SELinux is preventing bash (staff_t) "write" to ./ccache (var_t).

Detailed Description:

SELinux denied access requested by bash. It is not expected that this access is
required by bash and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./ccache,

restorecon -v './ccache'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                root:staff_r:staff_t:SystemLow-SystemHigh
Target Context                system_u:object_r:var_t
Target Objects                ./ccache [ dir ]
Source                        bash
Source Path                   /bin/bash
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           bash-3.2-22.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-29.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
                              11:33:46 EDT 2008 i686 i686
Alert Count                   1
First Seen                    Wed 09 Apr 2008 07:03:18 PM CDT
Last Seen                     Wed 09 Apr 2008 07:03:18 PM CDT
Local ID                      8b8507ac-7e45-4ce0-b52f-b25b6c69c03f
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207785798.523:69): avc:  denied  { write }
for  pid=5092 comm="bash" name="ccache" dev=dm-0 ino=2485510
scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_t:s0
tclass=dir

host=localhost.localdomain type=SYSCALL msg=audit(1207785798.523:69): arch=40000003
syscall=33 success=no exit=-13 a0=9eaad78 a1=2 a2=d14ff4 a3=0 items=0 ppid=4990 pid=5092
auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5
comm="bash" exe="/bin/bash" subj=root:staff_r:staff_t:s0-s0:c0.c1023
key=(null)



Summary:

SELinux is preventing gnome-session (staff_t) "write" to ./fontconfig
(fonts_t).

Detailed Description:

SELinux denied access requested by gnome-session. It is not expected that this
access is required by gnome-session and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./fontconfig,

restorecon -v './fontconfig'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                root:staff_r:staff_t:SystemLow-SystemHigh
Target Context                system_u:object_r:fonts_t
Target Objects                ./fontconfig [ dir ]
Source                        gnome-session
Source Path                   /usr/bin/gnome-session
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           gnome-session-2.22.1-1.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-29.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
                              11:33:46 EDT 2008 i686 i686
Alert Count                   1
First Seen                    Wed 09 Apr 2008 07:03:18 PM CDT
Last Seen                     Wed 09 Apr 2008 07:03:18 PM CDT
Local ID                      fddf24c2-0902-4a50-8909-4bd30c0839b6
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207785798.732:70): avc:  denied  { write }
for  pid=5092 comm="gnome-session" name="fontconfig" dev=dm-0
ino=2387443 scontext=root:staff_r:staff_t:s0-s0:c0.c1023
tcontext=system_u:object_r:fonts_t:s0 tclass=dir

host=localhost.localdomain type=SYSCALL msg=audit(1207785798.732:70): arch=40000003
syscall=33 success=no exit=-13 a0=8536358 a1=2 a2=a85694 a3=852daa8 items=0 ppid=4990
pid=5092 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=5
comm="gnome-session" exe="/usr/bin/gnome-session"
subj=root:staff_r:staff_t:s0-s0:c0.c1023 key=(null)


Summary:

SELinux is preventing escd (user_t) "write" to ./coolkey (auth_cache_t).

Detailed Description:

SELinux denied access requested by escd. It is not expected that this access is
required by escd and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./coolkey,

restorecon -v './coolkey'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                user_u:user_r:user_t
Target Context                system_u:object_r:auth_cache_t
Target Objects                ./coolkey [ dir ]
Source                        escd
Source Path                   /usr/lib/esc-1.0.1/escd
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           esc-1.0.1-9.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-29.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
                              11:33:46 EDT 2008 i686 i686
Alert Count                   4
First Seen                    Wed 09 Apr 2008 06:34:01 PM CDT
Last Seen                     Wed 09 Apr 2008 07:02:51 PM CDT
Local ID                      08e479ee-11d3-4d0c-892c-e8ce4f8beb7b
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207785771.193:60): avc:  denied  { write }
for  pid=4321 comm="escd" name="coolkey" dev=dm-0 ino=2485506
scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:auth_cache_t:s0 tclass=dir

host=localhost.localdomain type=SYSCALL msg=audit(1207785771.193:60): arch=40000003
syscall=5 success=no exit=-13 a0=88b4ba0 a1=4c2 a2=180 a3=88b3508 items=0 ppid=1 pid=4321
auid=502 uid=502 gid=502 euid=502 suid=502 fsuid=502 egid=502 sgid=502 fsgid=502
tty=(none) ses=3 comm="escd" exe="/usr/lib/esc-1.0.1/escd"
subj=user_u:user_r:user_t:s0 key=(null)



Summary:

SELinux is preventing userhelper (user_t) "read write" to ./eject
(userhelper_conf_t).

Detailed Description:

SELinux denied access requested by userhelper. It is not expected that this
access is required by userhelper and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./eject,

restorecon -v './eject'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                user_u:user_r:user_t
Target Context                system_u:object_r:userhelper_conf_t
Target Objects                ./eject [ file ]
Source                        userhelper
Source Path                   /usr/sbin/userhelper
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           usermode-1.96-1
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-29.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
                              11:33:46 EDT 2008 i686 i686
Alert Count                   3
First Seen                    Wed 09 Apr 2008 06:34:03 PM CDT
Last Seen                     Wed 09 Apr 2008 06:54:10 PM CDT
Local ID                      971298b0-6bc0-4ee0-a08e-efb07076dd3d
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207785250.626:49): avc:  denied  { read
write } for  pid=4559 comm="userhelper" name="eject" dev=dm-0
ino=4055485 scontext=user_u:user_r:user_t:s0
tcontext=system_u:object_r:userhelper_conf_t:s0 tclass=file

host=localhost.localdomain type=SYSCALL msg=audit(1207785250.626:49): arch=40000003
syscall=5 success=no exit=-13 a0=82e3508 a1=2 a2=b809cee0 a3=82e3530 items=0 ppid=4558
pid=4559 auid=502 uid=502 gid=502 euid=0 suid=0 fsuid=0 egid=502 sgid=502 fsgid=502
tty=(none) ses=3 comm="userhelper" exe="/usr/sbin/userhelper"
subj=user_u:user_r:user_t:s0 key=(null)



Summary:

SELinux is preventing userhelper (user_t) "read" to ./eject
(userhelper_conf_t).

Detailed Description:

SELinux denied access requested by userhelper. It is not expected that this
access is required by userhelper and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./eject,

restorecon -v './eject'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                user_u:user_r:user_t
Target Context                system_u:object_r:userhelper_conf_t
Target Objects                ./eject [ file ]
Source                        userhelper
Source Path                   /usr/sbin/userhelper
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           usermode-1.96-1
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-29.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
                              11:33:46 EDT 2008 i686 i686
Alert Count                   3
First Seen                    Wed 09 Apr 2008 06:34:03 PM CDT
Last Seen                     Wed 09 Apr 2008 06:54:10 PM CDT
Local ID                      fe10c9ad-5af2-4402-b68e-8d6951329af6
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207785250.628:50): avc:  denied  { read }
for  pid=4559 comm="userhelper" name="eject" dev=dm-0 ino=4055485
scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:userhelper_conf_t:s0
tclass=file

host=localhost.localdomain type=SYSCALL msg=audit(1207785250.628:50): arch=40000003
syscall=5 success=no exit=-13 a0=82e3508 a1=0 a2=b809cee0 a3=82e3530 items=0 ppid=4558
pid=4559 auid=502 uid=502 gid=502 euid=0 suid=0 fsuid=0 egid=502 sgid=502 fsgid=502
tty=(none) ses=3 comm="userhelper" exe="/usr/sbin/userhelper"
subj=user_u:user_r:user_t:s0 key=(null)


Summary:

SELinux is preventing escd (user_t) "read write" to
./636F6F6C6B6579706B313173452D47617465203020302D353031 (auth_cache_t).

Detailed Description:

SELinux denied access requested by escd. It is not expected that this access is
required by escd and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for
./636F6F6C6B6579706B313173452D47617465203020302D353031,

restorecon -v './636F6F6C6B6579706B313173452D47617465203020302D353031'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                user_u:user_r:user_t
Target Context                system_u:object_r:auth_cache_t
Target Objects                ./636F6F6C6B6579706B313173452D47617465203020302D35
                              3031 [ file ]
Source                        escd
Source Path                   /usr/lib/esc-1.0.1/escd
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           esc-1.0.1-9.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-29.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
                              11:33:46 EDT 2008 i686 i686
Alert Count                   2
First Seen                    Wed 09 Apr 2008 06:49:21 PM CDT
Last Seen                     Wed 09 Apr 2008 06:51:48 PM CDT
Local ID                      655d0a34-ec8a-4327-ae0c-a21175fccec7
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207785108.494:39): avc:  denied  { read
write } for  pid=3737 comm="escd"
name=636F6F6C6B6579706B313173452D47617465203020302D353031 dev=dm-0 ino=2485541
scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:auth_cache_t:s0 tclass=file

host=localhost.localdomain type=SYSCALL msg=audit(1207785108.494:39): arch=40000003
syscall=5 success=no exit=-13 a0=880aba0 a1=20002 a2=180 a3=0 items=0 ppid=1 pid=3737
auid=501 uid=501 gid=501 euid=501 suid=501 fsuid=501 egid=501 sgid=501 fsgid=501
tty=(none) ses=2 comm="escd" exe="/usr/lib/esc-1.0.1/escd"
subj=user_u:user_r:user_t:s0 key=(null)





Summary:

SELinux is preventing wine-preloader (user_t) "mmap_zero" to <Unknown>
(user_t).

Detailed Description:

SELinux denied access requested by wine-preloader. It is not expected that this
access is required by wine-preloader and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                user_u:user_r:user_t
Target Context                user_u:user_r:user_t
Target Objects                None [ memprotect ]
Source                        wine-preloader
Source Path                   /usr/bin/wine-preloader
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           wine-core-0.9.58-1.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-29.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.204.rc8.git4.fc9.i686 #1 SMP Mon Apr 7
                              11:33:46 EDT 2008 i686 i686
Alert Count                   1
First Seen                    Wed 09 Apr 2008 06:50:02 PM CDT
Last Seen                     Wed 09 Apr 2008 06:50:02 PM CDT
Local ID                      6f6e94e5-fbf2-43ea-b941-dba1d1da982b
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207785002.401:35): avc:  denied  {
mmap_zero } for  pid=3847 comm="wine-preloader" scontext=user_u:user_r:user_t:s0
tcontext=user_u:user_r:user_t:s0 tclass=memprotect

host=localhost.localdomain type=SYSCALL msg=audit(1207785002.401:35): arch=40000003
syscall=90 success=no exit=-13 a0=bfed76dc a1=bfed76dc a2=60000000 a3=bfed76dc items=0
ppid=1 pid=3847 auid=501 uid=501 gid=501 euid=501 suid=501 fsuid=501 egid=501 sgid=501
fsgid=501 tty=(none) ses=2 comm="wine-preloader"
exe="/usr/bin/wine-preloader" subj=user_u:user_r:user_t:s0 key=(null)





Summary:

SELinux prevented X from using the terminal tty0.

Detailed Description:

SELinux prevented X from using the terminal tty0. In most cases daemons do not
need to interact with the terminal, usually these avc messages can be ignored.
All of the confined daemons should have dontaudit rules around using the
terminal. Please file a bug report
(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this selinux-policy.
If you would like to allow all daemons to interact with the terminal, you can
turn on the allow_daemons_use_tty boolean.

Allowing Access:

Changing the "allow_daemons_use_tty" boolean to true will allow this access:
"setsebool -P allow_daemons_use_tty=1."

Fix Command:

setsebool -P allow_daemons_use_tty=1

Additional Information:

Source Context                user_u:user_r:user_t
Target Context                system_u:object_r:tty_device_t
Target Objects                tty0 [ chr_file ]
Source                        X
Source Path                   /usr/bin/Xorg
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           xorg-x11-server-Xorg-1.4.99.901-17.20080401.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-28.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   allow_daemons_use_tty
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.201.rc8.git4.fc9.i686 #1 SMP Sun Apr 6
                              21:55:27 EDT 2008 i686 i686
Alert Count                   8
First Seen                    Fri 04 Apr 2008 06:52:01 PM CDT
Last Seen                     Mon 07 Apr 2008 08:13:50 PM CDT
Local ID                      4c3eddb6-6a5d-420f-a3de-1649183f872c
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207617230.297:90): avc:  denied  { setattr
} for  pid=5319 comm="X" name="tty0" dev=tmpfs ino=255
scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:tty_device_t:s0
tclass=chr_file

host=localhost.localdomain type=SYSCALL msg=audit(1207617230.297:90): arch=40000003
syscall=212 success=no exit=-13 a0=81bc13b a1=0 a2=0 a3=bfbd70b4 items=0 ppid=5318
pid=5319 auid=502 uid=502 gid=502 euid=0 suid=0 fsuid=0 egid=502 sgid=502 fsgid=502
tty=tty1 ses=8 comm="X" exe="/usr/bin/Xorg"
subj=user_u:user_r:user_t:s0 key=(null)





Summary:

SELinux is preventing gdb (xdm_t) "write" to ./rpm (rpm_var_lib_t).

Detailed Description:

SELinux denied access requested by gdb. It is not expected that this access is
required by gdb and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./rpm,

restorecon -v './rpm'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                system_u:system_r:xdm_t:SystemLow-SystemHigh
Target Context                system_u:object_r:rpm_var_lib_t
Target Objects                ./rpm [ dir ]
Source                        gdb
Source Path                   /usr/bin/gdb
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           gdb-6.8-1.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-26.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.195.rc8.git1.fc9.i686 #1 SMP Thu Apr 3
                              09:42:34 EDT 2008 i686 i686
Alert Count                   196
First Seen                    Fri 04 Apr 2008 06:48:42 PM CDT
Last Seen                     Fri 04 Apr 2008 07:56:14 PM CDT
Local ID                      bf5f7ea8-f1a0-46bb-ade6-45dc659e7c1f
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207356974.98:206): avc:  denied  { write }
for  pid=2534 comm="gdb" name="rpm" dev=dm-0 ino=2387395
scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir

host=localhost.localdomain type=SYSCALL msg=audit(1207356974.98:206): arch=40000003
syscall=33 success=no exit=-13 a0=a3ddfb8 a1=2 a2=3547a4 a3=a3dde80 items=0 ppid=2533
pid=2534 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb"
subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)





Summary:

SELinux is preventing gdb (xdm_t) "getattr" to /var/lib/rpm/Packages
(rpm_var_lib_t).

Detailed Description:

SELinux denied access requested by gdb. It is not expected that this access is
required by gdb and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for /var/lib/rpm/Packages,

restorecon -v '/var/lib/rpm/Packages'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                system_u:system_r:xdm_t:SystemLow-SystemHigh
Target Context                system_u:object_r:rpm_var_lib_t
Target Objects                /var/lib/rpm/Packages [ file ]
Source                        gdb
Source Path                   /usr/bin/gdb
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           gdb-6.8-1.fc9
Target RPM Packages           rpm-4.4.2.3-1.fc9
Policy RPM                    selinux-policy-3.3.1-26.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
                              2.6.25-0.195.rc8.git1.fc9.i686 #1 SMP Thu Apr 3
                              09:42:34 EDT 2008 i686 i686
Alert Count                   196
First Seen                    Fri 04 Apr 2008 06:48:42 PM CDT
Last Seen                     Fri 04 Apr 2008 07:56:14 PM CDT
Local ID                      adc70120-316b-494e-a25a-1a9f014c0282
Line Numbers                  

Raw Audit Messages            

host=localhost.localdomain type=AVC msg=audit(1207356974.99:207): avc:  denied  { getattr
} for  pid=2534 comm="gdb" path="/var/lib/rpm/Packages" dev=dm-0
ino=2387402 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file

host=localhost.localdomain type=SYSCALL msg=audit(1207356974.99:207): arch=40000003
syscall=195 success=no exit=-13 a0=a3ddf98 a1=bf9e3e9c a2=d14ff4 a3=64 items=0 ppid=2533
pid=2534 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) ses=4294967295 comm="gdb" exe="/usr/bin/gdb"
subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)


























__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com