tmpreaper and /var/cache/man

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Tom London wrote:
> Running latest Rawhide, targeted/enforcing.
> 
> tmpreaper is complaining about /var/cache/man:
> 
> /etc/cron.daily/tmpwatch:
> 
> error: opendir error on current directory /var/cache/man/cat1: Permission denied
> error: cleanup failed in /var/cache/man/cat1: Permission denied
> error: opendir error on current directory /var/cache/man/cat2: Permission denied
> error: cleanup failed in /var/cache/man/cat2: Permission denied
> error: opendir error on current directory /var/cache/man/cat3: Permission denied
> error: cleanup failed in /var/cache/man/cat3: Permission denied
> error: opendir error on current directory /var/cache/man/cat4: Permission denied
> error: cleanup failed in /var/cache/man/cat4: Permission denied
> <<<<<SNIP>>>>>
> 
> and
> 
> type=AVC msg=audit(1191001312.606:91): avc:  denied  { read } for
> pid=12019 comm="tmpwatch" name="cat9" dev=dm-0 ino=65624
> scontext=system_u:system_r:tmpreaper_t:s0
> tcontext=system_u:object_r:man_t:s0 tclass=dir
> type=SYSCALL msg=audit(1191001312.606:91): arch=40000003 syscall=5
> success=no exit=-13 a0=804ac12 a1=98800 a2=fd00 a3=0 items=0
> ppid=11987 pid=12019 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=(none) comm="tmpwatch"
> exe="/usr/sbin/tmpwatch" subj=system_u:system_r:tmpreaper_t:s0
> key=(null)
> type=AVC msg=audit(1191001312.608:92): avc:  denied  { read } for
> pid=12020 comm="tmpwatch" name="catn" dev=dm-0 ino=65625
> scontext=system_u:system_r:tmpreaper_t:s0
> tcontext=system_u:object_r:man_t:s0 tclass=dir
> type=SYSCALL msg=audit(1191001312.608:92): arch=40000003 syscall=5
> success=no exit=-13 a0=804ac12 a1=98800 a2=fd00 a3=0 items=0
> ppid=11987 pid=12020 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=(none) comm="tmpwatch"
> exe="/usr/sbin/tmpwatch" subj=system_u:system_r:tmpreaper_t:s0
> key=(null)
> 
> or
> 
> #============= tmpreaper_t ==============
> allow tmpreaper_t man_t:dir read;
> 
> [Guessing it wants more than just 'read'.....]
> 
> tom
Should be fixed in latest rawhide policy.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFHAcMmrlYvE4MpobMRAlhFAJ9bBdymfBW6hf6MHp30grdhd8dENwCcCLbJ
IOOMYvhCq9+vxia22sTVtnI=
=dBGS
-----END PGP SIGNATURE-----