SELinux alert in Fedora 21

[Shintaro Fujiwara]

Hi, I run SELinux on Fedora 21.
I got this alert.

What's this?


SELinux is preventing /usr/sbin/logrotate from read access on the directory
/var/cache/dnf.

*****  Plugin catchall (100. confidence) suggests
**************************
Additional Information:
Source Context                system_u:system_r:logrotate_t:s0-s0:c0.c1023
Target Context                system_u:object_r:rpm_var_cache_t:s0
Target Objects                /var/cache/dnf [ dir ]
Source                        logrotate
Source Path                   /usr/sbin/logrotate
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           logrotate-3.8.7-4.fc21.x86_64
Target RPM Packages
Policy RPM                    selinux-policy-3.13.1-99.fc21.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain
3.17.6-300.fc21.x86_64
                              #1 SMP Mon Dec 8 22:29:32 UTC 2014 x86_64
x86_64
Alert Count                   1
First Seen                    2014-12-15 07:21:01 JST
Last Seen                     2014-12-15 07:21:01 JST
Local ID                      4f20b888-a8fd-484b-a665-dcd7b149502d

Raw Audit Messages
type=AVC msg=audit(1418595661.775:465): avc:  denied  { read } for
pid=6758 comm="logrotate" name="dnf" dev="dm-1" ino=3148310
scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023
tcontext=system_u:object_r:rpm_var_cache_t:s0 tclass=dir permissive=0


type=SYSCALL msg=audit(1418595661.775:465): arch=x86_64 syscall=openat
success=no exit=EACCES a0=ffffffffffffff9c a1=7fffc09f1730 a2=90800 a3=0
items=0 ppid=6756 pid=6758 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) ses=3 comm=logrotate exe=/usr/sbin/logrotate
subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null)

Hash: logrotate,logrotate_t,rpm_var_cache_t,dir,read

[fujiwara at localhost ~]$ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      29



-- 
日本にヘヴィメタル・ハードロックを根付かせるページ
http://heavymetalhardrock.no-ip.info/

世界中でセキュアＯＳのSELinuxを使いやすくするフリーソフト
http://sourceforge.net/projects/segatex/

CMS（PHPとPostgreSQLを使ったフリーソフト）
http://sourceforge.net/projects/webon/
https://github.com/intrajp/irforum_jp
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.fedoraproject.org/pipermail/selinux/attachments/20141215/4ee41021/attachment.html>