depmod_t failure again..... sigh

[Tom London]

Today's yum update of kernel reports (in targeted/enforcing):

  Installing: kernel                       ####################### [10/60]
WARNING: Couldn't open directory
/tmp/initrd.fu5084/lib/modules/2.6.24-0.133.rc6.git8.fc9: Permission
denied
FATAL: Could not open
/tmp/initrd.fu5084/lib/modules/2.6.24-0.133.rc6.git8.fc9/modules.dep.temp
for writing: Permission denied

Here is the raw AVC:

type=AVC msg=audit(1199371409.130:30): avc:  denied  { search } for
pid=7185 comm="depmod" name="tmp" dev=dm-0 ino=2686977
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=system_u:object_r:tmp_t:s0 tclass=dir
type=SYSCALL msg=audit(1199371409.130:30): arch=40000003 syscall=5
success=no exit=-13 a0=8941070 a1=98800 a2=2e646f6d a3=8941110 items=0
ppid=4720 pid=7185 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371409.130:31): avc:  denied  { search } for
pid=7185 comm="depmod" name="tmp" dev=dm-0 ino=2686977
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=system_u:object_r:tmp_t:s0 tclass=dir
type=SYSCALL msg=audit(1199371409.130:31): arch=40000003 syscall=5
success=no exit=-13 a0=bfb012b0 a1=241 a2=1b6 a3=895d480 items=0
ppid=4720 pid=7185 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)

Removing kernel package, and rerunning in permissive mode yields:

type=AVC msg=audit(1199371729.926:38): avc:  denied  { search } for
pid=10294 comm="depmod" name="tmp" dev=dm-0 ino=2686977
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=system_u:object_r:tmp_t:s0 tclass=dir
type=AVC msg=audit(1199371729.926:38): avc:  denied  { search } for
pid=10294 comm="depmod" name="initrd.qF8194" dev=dm-0 ino=2687511
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
type=AVC msg=audit(1199371729.926:38): avc:  denied  { read } for
pid=10294 comm="depmod" name="2.6.24-0.133.rc6.git8.fc9" dev=dm-0
ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
type=SYSCALL msg=audit(1199371729.926:38): arch=40000003 syscall=5
success=yes exit=3 a0=8ac5070 a1=98800 a2=2e646f6d a3=8ac5110 items=0
ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371729.927:39): avc:  denied  { getattr } for
pid=10294 comm="depmod"
path="/tmp/initrd.qF8194/lib/modules/2.6.24-0.133.rc6.git8.fc9"
dev=dm-0 ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
type=SYSCALL msg=audit(1199371729.927:39): arch=40000003 syscall=197
success=yes exit=0 a0=3 a1=bfd6253c a2=950ff4 a3=3 items=0 ppid=7830
pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371729.927:40): avc:  denied  { read } for
pid=10294 comm="depmod" name="scsi_mod.ko" dev=dm-0 ino=2687575
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1199371729.927:40): arch=40000003 syscall=5
success=yes exit=4 a0=8ae2514 a1=0 a2=1b6 a3=8ae8c20 items=0 ppid=7830
pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371729.927:41): avc:  denied  { getattr } for
pid=10294 comm="depmod"
path="/tmp/initrd.qF8194/lib/modules/2.6.24-0.133.rc6.git8.fc9/scsi_mod.ko"
dev=dm-0 ino=2687575 scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1199371729.927:41): arch=40000003 syscall=197
success=yes exit=0 a0=4 a1=bfd6228c a2=950ff4 a3=8ae8c20 items=0
ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371729.931:42): avc:  denied  { write } for
pid=10294 comm="depmod" name="2.6.24-0.133.rc6.git8.fc9" dev=dm-0
ino=2687516 scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
type=AVC msg=audit(1199371729.931:42): avc:  denied  { add_name } for
pid=10294 comm="depmod" name="modules.dep.temp"
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
type=AVC msg=audit(1199371729.931:42): avc:  denied  { create } for
pid=10294 comm="depmod" name="modules.dep.temp"
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
type=AVC msg=audit(1199371729.931:42): avc:  denied  { write } for
pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0 ino=2687612
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1199371729.931:42): arch=40000003 syscall=5
success=yes exit=3 a0=bfd62510 a1=241 a2=1b6 a3=8b3b1e0 items=0
ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)
type=AVC msg=audit(1199371729.932:43): avc:  denied  { remove_name }
for  pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0
ino=2687612 scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=dir
type=AVC msg=audit(1199371729.932:43): avc:  denied  { rename } for
pid=10294 comm="depmod" name="modules.dep.temp" dev=dm-0 ino=2687612
scontext=unconfined_u:system_r:depmod_t:s0
tcontext=unconfined_u:object_r:rpm_script_tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1199371729.932:43): arch=40000003 syscall=38
success=yes exit=0 a0=bfd62510 a1=bfd62570 a2=8b3b1e0 a3=bfd62510
items=0 ppid=7830 pid=10294 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=unconfined_u:system_r:depmod_t:s0 key=(null)

or
#============= depmod_t ==============
allow depmod_t rpm_script_tmp_t:dir { write search read remove_name
getattr add_name };
allow depmod_t rpm_script_tmp_t:file { read write getattr create rename };
allow depmod_t tmp_t:dir search;


tom
-- 
Tom London