semodule denial

[Tony Molloy]

Hi,

I'm getting the following denial on a fully updated Centos 5.3 system
with ( selinux-policy-2.4.6-203.el5.noarch )

Summary:

SELinux is preventing semodule (semanage_t) "getattr" to / (fs_t).

Detailed Description:

SELinux denied access requested by semodule. It is not expected that this 
access
is required by semodule and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not 
recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                root:system_r:semanage_t:SystemLow-SystemHigh
Target Context                system_u:object_r:fs_t
Target Objects                / [ filesystem ]
Source                        semodule
Source Path                   <Unknown>
Port                          <Unknown>
Host                          a.b.c.d
Source RPM Packages           
Target RPM Packages           filesystem-2.4.0-2.el5.centos
Policy RPM                    selinux-policy-2.4.6-203.el5
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     a.b.c.d
Platform                      Linux a.b.c.d 2.6.18-128.1.6.el5
                              #1 SMP Wed Apr 1 09:10:25 EDT 2009 x86_64 x86_64
Alert Count                   1
First Seen                    Thu Apr 23 08:53:08 2009
Last Seen                     Thu Apr 23 08:53:08 2009
Local ID                      227642bc-dd66-4a04-bcad-13c3d52e5e63
Line Numbers                  
Raw Audit Messages            

host=a.b.c.d type=AVC msg=audit(1240473188.358:3149): avc:  denied  { 
getattr } for  pid=29325 comm="semodule" name="/" dev=sda5 ino=2 
scontext=root:system_r:semanage_t:s0-s0:c0.c1023 
tcontext=system_u:object_r:fs_t:s0 tclass=filesystem

I can generate local policy but is that the best solution

Regards,

Tony

-- 

Dept. of Comp. Sci.
University of Limerick.