I have an SE Linux alert that won't go away

[ToddAndMargo]

Hi All,

I have an SE Linux alert that keeps coming back and back.

# ausearch -c 'geoclue' --raw | audit2allow -M my-geoclue
# semodule -X 300 -i my-geoclue.pp

Gets rid of it for a day.

And I know that geoclue has issues at the moment:

     Unable to connect to GeoClue. Unable to get location from provider. 
#318
     https://github.com/jonls/redshift/issues/318#issuecomment-401908696

     Redshift cannot get location:
     https://bugzilla.redhat.com/show_bug.cgi?id=1585970

Any words of Wisdom?


Many thanks,
-T



SELinux is preventing geoclue from getattr access on the file 
/proc/<pid>/cgroup.

*****  Plugin catchall (100. confidence) suggests 
**************************

If you believe that geoclue should be allowed getattr access on the 
cgroup file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'geoclue' --raw | audit2allow -M my-geoclue
# semodule -X 300 -i my-geoclue.pp

Additional Information:
Source Context                system_u:system_r:geoclue_t:s0
Target Context                system_u:system_r:unconfined_service_t:s0
Target Objects                /proc/<pid>/cgroup [ file ]
Source                        geoclue
Source Path                   geoclue
Port                          <Unknown>
Host                          server.storall.local
Source RPM Packages
Target RPM Packages
Policy RPM                    <Unknown>
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     server.storall.local
Platform                      Linux server.storall.local 
4.17.3-200.fc28.x86_64
                               #1 SMP Tue Jun 26 14:17:07 UTC 2018 
x86_64 x86_64
Alert Count                   1
First Seen                    2018-07-20 20:51:17 PDT
Last Seen                     2018-07-20 20:51:17 PDT
Local ID                      46bfb135-51d6-49d1-b573-eb3afe5c25b8

Raw Audit Messages
type=AVC msg=audit(1532145077.24:34049): avc:  denied  { getattr } for 
pid=11543 comm="geoclue" path="/proc/10951/cgroup"
dev="proc" 
ino=284431279 scontext=system_u:system_r:geoclue_t:s0 
tcontext=system_u:system_r:unconfined_service_t:s0 tclass=file permissive=0


Hash: geoclue,geoclue_t,unconfined_service_t,file,getattr