key {search write} for xdm_t (and /sbin/su)?

[Tom London]

Running latest rawhide, targeted/enforcing.

Notice the following in /var/log/audit/audit.log:

type=AVC msg=audit(1152981861.606:20): avc:  denied  { search } for
pid=2505 comm="gdm-binary"
scontext=system_u:system_r:xdm_t:s0-s0:c0.c255
tcontext=system_u:system_r:xdm_t:s0-s0:c0.c255 tclass=key
type=SYSCALL msg=audit(1152981861.606:20): arch=40000003 syscall=288
success=no exit=-13 a0=3 a1=292e05f8 a2=35ce48 a3=7ce759 items=0
ppid=2471 pid=2505 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0
sgid=500 fsgid=0 tty=(none) comm="gdm-binary"
exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c255
key=(null)

type=AVC msg=audit(1152981872.490:26): avc:  denied  { write } for
pid=2804 comm="gdm-binary"
scontext=system_u:system_r:xdm_t:s0-s0:c0.c255
tcontext=system_u:system_r:xdm_t:s0-s0:c0.c255 tclass=key
type=SYSCALL msg=audit(1152981872.490:26): arch=40000003 syscall=288
success=no exit=-13 a0=8 a1=fffffffc a2=fffffffd a3=1f4 items=0
ppid=2471 pid=2804 auid=4294967295 uid=500 gid=500 euid=0 suid=0
fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) comm="gdm-binary"
exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c255
key=(null)

and

type=AVC msg=audit(1152981908.300:32): avc:  denied  { write } for
pid=3037 comm="su" scontext=user_u:system_r:unconfined_t:s0
tcontext=user_u:system_r:unconfined_t:s0 tclass=key
type=SYSCALL msg=audit(1152981908.300:32): arch=40000003 syscall=288
success=no exit=-13 a0=8 a1=fffffffc a2=fffffffd a3=0 items=0
ppid=2984 pid=3037 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=500
sgid=500 fsgid=500 tty=pts0 comm="su" exe="/bin/su"
subj=user_u:system_r:unconfined_t:s0 key=(null)

Believe the second results from me entering 'su -'.

tom
-- 
Tom London