depmod_t failure again..... sigh

[Eric Paris]

Dan knows and he has it fixed on his local system, he will push it
rawhide soonish

-Eric

On Thu, 2008-01-03 at 06:51 -0800, Tom London wrote:
> Today's yum update of kernel reports (in targeted/enforcing):
> 
>   Installing: kernel                       ####################### [10/60]
> WARNING: Couldn't open directory
> /tmp/initrd.fu5084/lib/modules/2.6.24-0.133.rc6.git8.fc9: Permission
> denied
> FATAL: Could not open
> /tmp/initrd.fu5084/lib/modules/2.6.24-0.133.rc6.git8.fc9/modules.dep.temp
> for writing: Permission denied
> 
> Here is the raw AVC:
> 
> type=AVC msg=audit(1199371409.130:30): avc:  denied  { search } for
> pid=7185 comm="depmod" name="tmp" dev=dm-0 ino=2686977
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=system_u:object_r:tmp_t:s0 tclass=dir
> type=SYSCALL msg=audit(1199371409.130:30): arch=40000003 syscall=5
> success=no exit=-13 a0=8941070 a1=98800 a2=2e646f6d a3=8941110 items=0
> ppid=4720 pid=7185 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
> type=AVC msg=audit(1199371409.130:31): avc:  denied  { search } for
> pid=7185 comm="depmod" name="tmp" dev=dm-0 ino=2686977
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=system_u:object_r:tmp_t:s0 tclass=dir
> type=SYSCALL msg=audit(1199371409.130:31): arch=40000003 syscall=5
> success=no exit=-13 a0=bfb012b0 a1=241 a2=1b6 a3=895d480 items=0
> ppid=4720 pid=7185 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
> 
> Removing kernel package, and rerunning in permissive mode yields:
> 
> type=AVC msg=audit(1199371729.926:38): avc:  denied  { search } for
> pid=10294 comm="depmod" name="tmp" dev=dm-0 ino=2686977
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=system_u:object_r:tmp_t:s0 tclass=dir
> type=AVC msg=audit(1199371729.926:38): avc:  denied  { search } for
> pid=10294 comm="depmod" name="initrd.qF8194" dev=dm-0 ino=2687511
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
> type=AVC msg=audit(1199371729.926:38): avc:  denied  { read } for
> pid=10294 comm="depmod" name="2.6.24-0.133.rc6.git8.fc9" dev=dm-0
> ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
> type=SYSCALL msg=audit(1199371729.926:38): arch=40000003 syscall=5
> success=yes exit=3 a0=8ac5070 a1=98800 a2=2e646f6d a3=8ac5110 items=0
> ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
> type=AVC msg=audit(1199371729.927:39): avc:  denied  { getattr } for
> pid=10294 comm="depmod"
> path="/tmp/initrd.qF8194/lib/modules/2.6.24-0.133.rc6.git8.fc9"
> dev=dm-0 ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
> type=SYSCALL msg=audit(1199371729.927:39): arch=40000003 syscall=197
> success=yes exit=0 a0=3 a1=bfd6253c a2=950ff4 a3=3 items=0 ppid=7830
> pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
> type=AVC msg=audit(1199371729.927:40): avc:  denied  { read } for
> pid=10294 comm="depmod" name="scsi_mod.ko" dev=dm-0 ino=2687575
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
> type=SYSCALL msg=audit(1199371729.927:40): arch=40000003 syscall=5
> success=yes exit=4 a0=8ae2514 a1=0 a2=1b6 a3=8ae8c20 items=0 ppid=7830
> pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
> type=AVC msg=audit(1199371729.927:41): avc:  denied  { getattr } for
> pid=10294 comm="depmod"
> path="/tmp/initrd.qF8194/lib/modules/2.6.24-0.133.rc6.git8.fc9/scsi_mod.ko"
> dev=dm-0 ino=2687575 scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
> type=SYSCALL msg=audit(1199371729.927:41): arch=40000003 syscall=197
> success=yes exit=0 a0=4 a1=bfd6228c a2=950ff4 a3=8ae8c20 items=0
> ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
> type=AVC msg=audit(1199371729.931:42): avc:  denied  { write } for
> pid=10294 comm="depmod" name="2.6.24-0.133.rc6.git8.fc9" dev=dm-0
> ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
> type=AVC msg=audit(1199371729.931:42): avc:  denied  { add_name } for
> pid=10294 comm="depmod" name="modules.dep.temp"
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
> type=AVC msg=audit(1199371729.931:42): avc:  denied  { create } for
> pid=10294 comm="depmod" name="modules.dep.temp"
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
> type=AVC msg=audit(1199371729.931:42): avc:  denied  { write } for
> pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0 ino=2687612
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
> type=SYSCALL msg=audit(1199371729.931:42): arch=40000003 syscall=5
> success=yes exit=3 a0=bfd62510 a1=241 a2=1b6 a3=8b3b1e0 items=0
> ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
> type=AVC msg=audit(1199371729.932:43): avc:  denied  { remove_name }
> for  pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0
> ino=2687612 scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
> type=AVC msg=audit(1199371729.932:43): avc:  denied  { rename } for
> pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0 ino=2687612
> scontext=unconfined_u:system_r:depmod_t:s0
> tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
> type=SYSCALL msg=audit(1199371729.932:43): arch=40000003 syscall=38
> success=yes exit=0 a0=bfd62510 a1=bfd62570 a2=8b3b1e0 a3=bfd62510
> items=0 ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
> subj=unconfined_u:system_r:depmod_t:s0 key=(null)
> 
> or
> #============= depmod_t ==============
> allow depmod_t rpm_script_tmp_t:dir { write search read remove_name
> getattr add_name };
> allow depmod_t rpm_script_tmp_t:file { read write getattr create rename };
> allow depmod_t tmp_t:dir search;
> 
> 
> tom