FC3 " avc: denied" issue

[Russell Coker]

On Sunday 26 December 2004 12:18, "Erwin J. Prinz" <ejprinz at austin.rr.com> 
wrote:
> Dec 25 18:51:34 tiger kernel: audit(1104022294.445:0): avc:  denied  {
> write } for  pid=3956 exe=/sbin/ldconfig
> path=/var/log/nvidia-installer.log dev=hda6 ino=517383
> scontext=root:system_r:ldconfig_t tcontext=system_u:object_r:var_log_t
> tclass=file

Looks like the command is "ldconfig >> /var/log/nvidia-installer.log", this is 
no problem, ldconfig generally doesn't give any interesting output.

> Dec 25 18:51:35 tiger kernel: audit(1104022295.012:0): avc:  denied  {
> getattr } for  pid=3956 exe=/sbin/ldconfig
> path=/usr/X11R6/lib/libXvMCNVIDIA.so.1.0.6629 dev=hda4 ino=194830
> scontext=root:system_r:ldconfig_t tcontext=root:object_r:lib_t tclass=file

The file contexts seem OK for that.  I guess that you installed it from a .tar 
file not an rpm package and didn't use restorecon to fix it's label.

> Dec 25 18:51:38 tiger kernel: audit(1104022298.997:0): avc:  denied  {
> getattr } for  pid=3956 exe=/sbin/ldconfig
> path=/usr/lib/libGL.so.1.0.6629 dev=hda4 ino=521611
> scontext=root:system_r:ldconfig_t tcontext=root:object_r:lib_t
> tclass=file

Report a bug to whoever provided the collection of files that their install 
script should do the following:
restorecon /usr/X11R6/lib/libXvMCNVIDIA.so.1.0.6629
restorecon /usr/lib/libGL.so.1.0.6629

> I don't think the issue is with the NVIDIA drivers as they worked on FC3
> before, and as "setenforce 0" "fixes" the issue.

FC3 has SE Linux enabled by default.  Anything that is designed for FC3 has to 
be designed to work with SE Linux.  It seems that the NVIDIA driver archive 
is not designed to do so.  It would be much easier if they just provided a 
RPM.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page