Summary
SELinux is preventing /usr/sbin/ztcfg (insmod_t) "read write" access to
device <Unknown>.
Detailed Description
SELinux has denied the /usr/sbin/ztcfg (insmod_t) "read write" access to
device <Unknown>. <Unknown> is mislabeled, this device has the default label
of the /dev directory, which should not happen. All Character and/or Block
Devices should have a label. You can attempt to change the label of the file
using restorecon -v <Unknown>. If this device remains labeled device_t, then
this is a bug in SELinux policy. Please file a
http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against the selinux-policy
package. If you look at the other similar devices labels, ls -lZ
/dev/SIMILAR, and find a type that would work for <Unknown>, you can use
chcon -t SIMILAR_TYPE <Unknown>, If this fixes the problem, you can make
this permanent by executing semanage fcontext -a -t SIMILAR_TYPE <Unknown>
If the restorecon changes the context, this indicates that the application
that created the device, created it without using SELinux APIs. If you can
figure out which application created the device, please file a
http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this application.
Allowing Access
Attempt restorecon -v <Unknown> or chcon -t SIMILAR_TYPE <Unknown>
Additional Information
Source Context system_u:system_r:insmod_t:s0
Target Context system_u:object_r:device_t:s0
Target Objects None [ chr_file ]
Affected RPM Packages zaptel-1.4.6-8.3226.fc8.lc [application]
Policy RPM selinux-policy-3.0.8-47.fc8
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name plugins.device
Host Name localhost.localdomain
Platform Linux localhost.localdomain 2.6.23.1-49.fc8 #1 SMP
Thu Nov 8 22:14:09 EST 2007 x86_64 x86_64
Alert Count 26
First Seen Tue Nov 13 15:18:42 2007
Last Seen Tue Nov 13 15:50:45 2007
Local ID e5c4fb26-cbea-4a95-9be3-3ab897b94903
Line Numbers
Raw Audit Messages
avc: denied { read write } for comm=ztcfg dev=tmpfs egid=0 euid=0
exe=/usr/sbin/ztcfg exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name=ctl pid=16191
scontext=system_u:system_r:insmod_t:s0 sgid=0 subj=system_u:system_r:insmod_t:s0
suid=0 tclass=chr_file tcontext=system_u:object_r:device_t:s0 tty=(none) uid=0
[root@localhost ~]# ls -Z /dev
[snip]
drwxr-xr-x root root system_u:object_r:device_t:s0 zap
[snip]
[root@localhost ~]# ls -Z /dev/zap
crw-rw---- asterisk asterisk system_u:object_r:device_t:s0 channel
crw-rw---- asterisk asterisk system_u:object_r:device_t:s0 ctl
crw-rw---- asterisk asterisk system_u:object_r:device_t:s0 pseudo
crw-rw---- asterisk asterisk system_u:object_r:device_t:s0 timer
crw-rw---- asterisk asterisk system_u:object_r:device_t:s0 transcode
UDEV rules (file: 40-zaptel.rules):
# zaptel devices with ownership/permissions for running as non-root
KERNEL=="zapctl", NAME="zap/ctl", OWNER="asterisk", GROUP="asterisk", MODE="0660", OPTIONS="last_rule"
KERNEL=="zaptranscode", NAME="zap/transcode", OWNER="asterisk", GROUP="asterisk", MODE="0660", OPTIONS="last_rule"
KERNEL=="zaptimer", NAME="zap/timer", OWNER="asterisk", GROUP="asterisk", MODE="0660", OPTIONS="last_rule"
KERNEL=="zapchannel", NAME="zap/channel", OWNER="asterisk", GROUP="asterisk", MODE="0660", OPTIONS="last_rule"
KERNEL=="zappseudo", NAME="zap/pseudo", OWNER="asterisk", GROUP="asterisk", MODE="0660", OPTIONS="last_rule"
KERNEL=="zap[0-9]*", NAME="zap/%n", OWNER="asterisk", GROUP="asterisk", MODE="0660", OPTIONS="last_rule"