Today's yum update of kernel reports (in targeted/enforcing):
Installing: kernel ####################### [10/60] WARNING: Couldn't open directory /tmp/initrd.fu5084/lib/modules/2.6.24-0.133.rc6.git8.fc9: Permission denied FATAL: Could not open /tmp/initrd.fu5084/lib/modules/2.6.24-0.133.rc6.git8.fc9/modules.dep.temp for writing: Permission denied
Here is the raw AVC:
type=AVC msg=audit(1199371409.130:30): avc: denied { search } for pid=7185 comm="depmod" name="tmp" dev=dm-0 ino=2686977 scontext=unconfined_u:system_r:depmod_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=SYSCALL msg=audit(1199371409.130:30): arch=40000003 syscall=5 success=no exit=-13 a0=8941070 a1=98800 a2=2e646f6d a3=8941110 items=0 ppid=4720 pid=7185 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod" subj=unconfined_u:system_r:depmod_t:s0 key=(null) type=AVC msg=audit(1199371409.130:31): avc: denied { search } for pid=7185 comm="depmod" name="tmp" dev=dm-0 ino=2686977 scontext=unconfined_u:system_r:depmod_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=SYSCALL msg=audit(1199371409.130:31): arch=40000003 syscall=5 success=no exit=-13 a0=bfb012b0 a1=241 a2=1b6 a3=895d480 items=0 ppid=4720 pid=7185 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod" subj=unconfined_u:system_r:depmod_t:s0 key=(null)
Removing kernel package, and rerunning in permissive mode yields:
type=AVC msg=audit(1199371729.926:38): avc: denied { search } for pid=10294 comm="depmod" name="tmp" dev=dm-0 ino=2686977 scontext=unconfined_u:system_r:depmod_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=AVC msg=audit(1199371729.926:38): avc: denied { search } for pid=10294 comm="depmod" name="initrd.qF8194" dev=dm-0 ino=2687511 scontext=unconfined_u:system_r:depmod_t:s0 tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir type=AVC msg=audit(1199371729.926:38): avc: denied { read } for pid=10294 comm="depmod" name="2.6.24-0.133.rc6.git8.fc9" dev=dm-0 ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0 tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir type=SYSCALL msg=audit(1199371729.926:38): arch=40000003 syscall=5 success=yes exit=3 a0=8ac5070 a1=98800 a2=2e646f6d a3=8ac5110 items=0 ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod" subj=unconfined_u:system_r:depmod_t:s0 key=(null) type=AVC msg=audit(1199371729.927:39): avc: denied { getattr } for pid=10294 comm="depmod" path="/tmp/initrd.qF8194/lib/modules/2.6.24-0.133.rc6.git8.fc9" dev=dm-0 ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0 tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir type=SYSCALL msg=audit(1199371729.927:39): arch=40000003 syscall=197 success=yes exit=0 a0=3 a1=bfd6253c a2=950ff4 a3=3 items=0 ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod" subj=unconfined_u:system_r:depmod_t:s0 key=(null) type=AVC msg=audit(1199371729.927:40): avc: denied { read } for pid=10294 comm="depmod" name="scsi_mod.ko" dev=dm-0 ino=2687575 scontext=unconfined_u:system_r:depmod_t:s0 tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file type=SYSCALL msg=audit(1199371729.927:40): arch=40000003 syscall=5 success=yes exit=4 a0=8ae2514 a1=0 a2=1b6 a3=8ae8c20 items=0 ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod" subj=unconfined_u:system_r:depmod_t:s0 key=(null) type=AVC msg=audit(1199371729.927:41): avc: denied { getattr } for pid=10294 comm="depmod" path="/tmp/initrd.qF8194/lib/modules/2.6.24-0.133.rc6.git8.fc9/scsi_mod.ko" dev=dm-0 ino=2687575 scontext=unconfined_u:system_r:depmod_t:s0 tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file type=SYSCALL msg=audit(1199371729.927:41): arch=40000003 syscall=197 success=yes exit=0 a0=4 a1=bfd6228c a2=950ff4 a3=8ae8c20 items=0 ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod" subj=unconfined_u:system_r:depmod_t:s0 key=(null) type=AVC msg=audit(1199371729.931:42): avc: denied { write } for pid=10294 comm="depmod" name="2.6.24-0.133.rc6.git8.fc9" dev=dm-0 ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0 tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir type=AVC msg=audit(1199371729.931:42): avc: denied { add_name } for pid=10294 comm="depmod" name="modules.dep.temp" scontext=unconfined_u:system_r:depmod_t:s0 tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir type=AVC msg=audit(1199371729.931:42): avc: denied { create } for pid=10294 comm="depmod" name="modules.dep.temp" scontext=unconfined_u:system_r:depmod_t:s0 tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file type=AVC msg=audit(1199371729.931:42): avc: denied { write } for pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0 ino=2687612 scontext=unconfined_u:system_r:depmod_t:s0 tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file type=SYSCALL msg=audit(1199371729.931:42): arch=40000003 syscall=5 success=yes exit=3 a0=bfd62510 a1=241 a2=1b6 a3=8b3b1e0 items=0 ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod" subj=unconfined_u:system_r:depmod_t:s0 key=(null) type=AVC msg=audit(1199371729.932:43): avc: denied { remove_name } for pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0 ino=2687612 scontext=unconfined_u:system_r:depmod_t:s0 tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir type=AVC msg=audit(1199371729.932:43): avc: denied { rename } for pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0 ino=2687612 scontext=unconfined_u:system_r:depmod_t:s0 tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file type=SYSCALL msg=audit(1199371729.932:43): arch=40000003 syscall=38 success=yes exit=0 a0=bfd62510 a1=bfd62570 a2=8b3b1e0 a3=bfd62510 items=0 ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod" subj=unconfined_u:system_r:depmod_t:s0 key=(null)
or #============= depmod_t ============== allow depmod_t rpm_script_tmp_t:dir { write search read remove_name getattr add_name }; allow depmod_t rpm_script_tmp_t:file { read write getattr create rename }; allow depmod_t tmp_t:dir search;
tom