文件操作 - pcpupstream.te
返回文件管理
返回主菜单
删除本文件
文件: /var/lib/pcp/selinux/pcpupstream.te
编辑文件内容
module pcpupstream 4.3.2; require { attribute domain; attribute userdomain; attribute file_type; attribute pcp_domain; type pcp_pmcd_t; type tmp_t; type init_t; type default_t; type gpmctl_t; type pcp_pmlogger_t; type pcp_pmlogger_exec_t; type pcp_var_lib_t; type pcp_log_t; type pcp_pmie_t; type pcp_pmproxy_t; type pcp_pmmgr_t; type pcp_tmp_t; type pcp_pmwebd_t; type pcp_pmie_exec_t; # pmdasummary type websm_port_t; # pmda.prometheus type system_cronjob_t; type user_home_t; type user_tmp_t; type debugfs_t; type nsfs_t; # filesys.used type unreserved_port_t; type hostname_exec_t; type tracefs_t; type haproxy_t; type haproxy_var_lib_t; type sysctl_fs_t; #RHBZ1505888 type sysfs_t; #RHBZ1545245 type modules_object_t; # pcp.lio, pcp.bcc type setfiles_exec_t; type mdadm_exec_t; type ndc_exec_t; type proc_mdstat_t; type numad_t; type glusterd_log_t; type sysctl_irq_t; #pmda.bcc type unconfined_t; #RHBZ1443632 type unconfined_service_t; type configfs_t; #pcp.lio type ldconfig_exec_t; type sysctl_net_t; type proc_net_t; #RHBZ1517656 type fsadm_exec_t; type kernel_t; type kmsg_device_t; type proc_kcore_t; type su_exec_t; class sem { unix_read associate getattr read }; class lnk_file { read getattr }; class file { append create execute execute_no_trans getattr setattr ioctl lock open read write unlink map }; class dir { add_name open read search write getattr lock ioctl }; class unix_stream_socket connectto; class capability { kill dac_override sys_ptrace net_admin chown sys_chroot ipc_lock ipc_owner sys_resource fowner sys_rawio fsetid }; class cap_userns sys_ptrace; # pmdaproc class chr_file { open write }; class fifo_file { getattr read open unlink lock ioctl }; # qa/455 class process { signull signal execmem setrlimit ptrace }; #RHBZ1443632 class sock_file { getattr write }; #RHBZ1449671, RHBZ1449671 class tcp_socket { name_bind name_connect }; class shm { unix_read associate getattr read }; class filesystem mount; class blk_file { ioctl open read }; class msgq { unix_read }; class unix_dgram_socket { sendto }; class dbus { send_msg }; class bpf { map_create map_read map_write prog_load prog_run }; class system { module_request }; } #============= init_t ============== # type=AVC msg=audit(YYY.1): avc: denied { read } for pid=21999 comm="pmcd" name="pmcd" dev="dm-1" ino=936441 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:pcp_log_t:s0 tclass=dir permissive=0 allow init_t pcp_log_t:dir read; allow init_t pcp_log_t:file getattr; # type=AVC msg=audit(YYY.2): avc: denied { getattr } for pid=21999 comm="pmcd" path="/var/lib/pcp/pmns/root" dev="dm-1" ino=945382 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:pcp_var_lib_t:s0 tclass=file permissive=0 allow init_t pcp_var_lib_t:dir { add_name read write }; #type=AVC msg=audit(YYY.3): avc: denied { execute } for pid=21999 comm="pmcd" name="Rebuild" dev="dm-1" ino=937158 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:pcp_var_lib_t:s0 tclass=file permissive=0 # execute allow init_t pcp_var_lib_t:file { append create execute execute_no_trans getattr ioctl open read write }; allow init_t pcp_var_lib_t:lnk_file read; # type=AVC msg=audit(YYY.4): avc: denied { open } for pid=21901 comm="pmcd" path="/var/tmp/pcp.sQReBLg6R/pcp.env.path" dev="dm-1" ino=930323 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file permissive=0 # allow init_t tmp_t:file open; #type=USER_AVC msg=audit(YYY.5): pid=775 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.14778 spid=1 tpid=19555 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' allow init_t system_cronjob_t:dbus send_msg; #============= pcp_pmcd_t ============== #SYN AVC for testing #type=AVC msg=audit(XXX.4): avc: denied { execute execute_no_trans open read } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:user_home_t:s0 tclass=file permissive=0 allow pcp_pmcd_t user_home_t:file { execute execute_no_trans }; #type=AVC msg=audit(XXX.6): avc: denied { append getattr ioctl open read write } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=0 allow pcp_pmcd_t debugfs_t:file { append getattr ioctl open read write }; #type=AVC msg=audit(XXX.7): avc: denied { execute execute_no_trans open read } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmie_exec_t:s0 tclass=file permissive=0 #type=AVC msg=audit(XXX.68): avc: denied { map } for pid=28290 comm="pmie" path="/usr/bin/pmie" dev="dm-0" ino=5443 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmie_exec_t:s0 tclass=file permissive=0 allow pcp_pmcd_t pcp_pmie_exec_t:file { execute execute_no_trans open read map }; #type=AVC msg=audit(XXX.8): avc: denied { getattr open read unlink } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_var_lib_t:s0 tclass=fifo_file permissive=0 allow pcp_pmcd_t pcp_var_lib_t:fifo_file { getattr open read unlink }; #RHBZ1460131 #type=AVC msg=audit(XXX.9): avc: denied { getattr } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file permissive=0 allow pcp_pmcd_t proc_kcore_t:file getattr; #type=AVC msg=audit(YYY.11): avc: denied { sys_chroot kill sys_resource } for pid=25873 comm="pmdalinux" capability=18 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability #type=AVC msg=audit(YYY.87): avc: denied { chown } for pid=8999 comm="pmdasimple" capability=0 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability allow pcp_pmcd_t self:capability { sys_chroot kill sys_resource ipc_lock chown }; #type=AVC msg=audit(YYY.12): avc: denied { read } for pid=29112 comm="pmdalinux" dev="nsfs" ino=4026532454 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nsfs_t:s0 tclass=file permissive=1 allow pcp_pmcd_t nsfs_t:file { read open }; #type=AVC msg=audit(YYY.13): avc: denied { name_bind } for pid=7079 comm="pmdasimple" src=5650 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0 #type=AVC msg=audit(YYY.14): avc: denied { name_connect } for pid=29238 comm="pmcd" dest=5650 scontex =system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0 allow pcp_pmcd_t unreserved_port_t:tcp_socket { name_bind name_connect }; #type=AVC msg=audit(YYY.15): avc: denied { name_connect } for pid=13816 comm="python3" dest=9090 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:websm_port_t:s0 tclass=tcp_socket permissive=0 allow pcp_pmcd_t websm_port_t:tcp_socket name_connect; # pmda.prometheus #type=AVC msg=audit(YYY.21): avc: denied { execute } for pid=8648 comm="sh" name="8641" dev="tmpfs" ino=246964 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_tmp_t:s0 tclass=file permissive=0 #type=AVC msg=audit(YYY.22): avc: denied { execute_no_trans } for pid=8648 comm="sh" path="/tmp/8641" dev="tmpfs" ino=246964 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_tmp_t:s0 tclass=file permissive=0 allow pcp_pmcd_t pcp_tmp_t:file { execute execute_no_trans map }; #type=AVC msg=audit(YYY.23): avc: denied { getattr } for pid=8656 comm="sh" path="/usr/bin/hostname" dev="dm-1" ino=1051243 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file permissive=0 #type=AVC msg=audit(YYY.24): avc: denied { execute } for pid=8656 comm="sh" name="hostname" dev="dm-1" ino=1051243 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file permissive=0 #type=AVC msg=audit(YYY.25): avc: denied { read } for pid=8656 comm="sh" name="hostname" dev="dm-1" ino=1051243 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file permissive=0 #type=AVC msg=audit(YYY.26): avc: denied { open } for pid=8657 comm="sh" path="/usr/bin/hostname" dev="dm-1" ino=1051243 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file permissive=0 #type=AVC msg=audit(YYY.27): avc: denied { execute_no_trans } for pid=8657 comm="sh" path="/usr/bin/hostname" dev="dm-1" ino=1051243 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file permissive=0 allow pcp_pmcd_t hostname_exec_t:file { getattr execute read open execute_no_trans }; #type=AVC msg=audit(YYY.28): avc: denied { mount } for pid=22090 comm="pmdaperfevent" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=filesystem permissive=0 allow pcp_pmcd_t tracefs_t:filesystem mount; #type=AVC msg=audit(YYY.29): avc: denied { search } for pid=22090 comm="pmdaperfevent" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=0 #type=AVC msg=audit(YYY.30): avc: denied { read } for pid=22090 comm="pmdaperfevent" name="events" dev="tracefs" ino=176 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=0 #type=AVC msg=audit(YYY.31): avc: denied { open } for pid=22090 comm="pmdaperfevent" path="/sys/kernel/debug/tracing/events" dev="tracefs" ino=176 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=0 #type=AVC msg=audit(YYY.88): avc: denied { read } for pid=2023 comm="pmdakvm" name="kvm" dev="tracefs" ino=18541 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=0 allow pcp_pmcd_t tracefs_t:dir { search read open }; #type=AVC msg=audit(YYY.32): avc: denied { read } for pid=22090 comm="pmdaperfevent" name="id" dev="tracefs" ino=321619 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=file permissive=0 #type=AVC msg=audit(YYY.33): avc: denied { open } for pid=22090 comm="pmdaperfevent" path="/sys/kernel/debug/tracing/events/gfs2/gfs2_glock_state_change/id" dev="tracefs" ino=321619 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=file permissive=0 allow pcp_pmcd_t tracefs_t:file { getattr read open append write }; #type=AVC msg=audit(YYY.37): avc: denied { getattr } for pid=YYYY comm="pmdaproc" path="/dev/gpmctl" dev="devtmpfs" ino=19750 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:gpmctl_t:s0 tclass=sock_file permissive=1 allow pcp_pmcd_t gpmctl_t:sock_file getattr; #type=AVC msg=audit(XXX.16): avc: denied { write } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:haproxy_var_lib_t:s0 tclass=sock_file permissive=0 allow pcp_pmcd_t haproxy_var_lib_t:sock_file write; #type=AVC msg=audit(YYY.34): avc: denied { write } for pid=2967 comm="pmdaxfs" name="stats_clear" dev="proc" ino=87731 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:sysctl_fs_t:s0 tclass=file #RHBZ1505888 allow pcp_pmcd_t sysctl_fs_t:file write; #type=AVC msg=audit(...): avc: denied { map } for pid=NNN comm="ldconfig" path="/usr/sbin/ldconfig" dev="dm-1" ino=1052382 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=1 allow pcp_pmcd_t ldconfig_exec_t:file map; #RHBZ1545245 #type=AVC msg=audit(XXX.23): avc: denied { write } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=0 allow pcp_pmcd_t sysfs_t:dir write; # pmda.bcc #type=AVC msg=audit(XXX.24): avc: denied { read } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=lnk_file permissive=0 allow pcp_pmcd_t modules_object_t:lnk_file read; #type=AVC msg=audit(XXX.26): avc: denied { execute execute_no_trans open read } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:mdadm_exec_t:s0 tclass=file permissive=0 allow pcp_pmcd_t mdadm_exec_t:file { execute execute_no_trans open read }; allow pcp_pmcd_t ndc_exec_t:file execute; #type=AVC msg=audit(XXX.27): avc: denied { getattr open read } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:proc_mdstat_t:s0 tclass=file permissive=0 allow pcp_pmcd_t proc_mdstat_t:file { getattr open read }; #type=AVC msg=audit(YYY.35): avc: denied { unix_read } for pid=1423 comm="pmdalinux" key=-559038737 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:numad_t:s0 tclass=msgq permissive=0 #type=AVC msg=audit(YYY.36): avc: denied { unix_read } for pid=1423 comm="pmdalinux" key=-559038737 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:numad_t:s0 tclass=msgq permissive=0 allow pcp_pmcd_t numad_t:msgq unix_read; #type=AVC msg=audit(XXX.28): avc: denied { open read write } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:glusterd_log_t:s0 tclass=file permissive=0 allow pcp_pmcd_t glusterd_log_t:file { open read write }; #pmda.bcc #type=AVC msg=audit(XXX.34): avc: denied { execmem setrlimit ptrace } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmcd_t:s0 tclass=process permissive=0 allow pcp_pmcd_t self:process { execmem setrlimit ptrace }; #type=AVC msg=audit(XXX.35): avc: denied { search } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:sysctl_irq_t:s0 tclass=dir permissive=0 allow pcp_pmcd_t sysctl_irq_t:dir { search }; #RHBZ1633211, RHBZ1693332 allow pcp_pmcd_t self:bpf { map_create map_read map_write prog_load prog_run }; #type=AVC msg=audit(XXX.41): avc: denied { signull } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:kernel_t:s0 tclass=process permissive=0 allow pcp_pmcd_t kernel_t:process signull; # pmda-bcc needs the ability to read addresses in /proc/kallsyms #RHBZ1690542 #type=AVC msg=audit(XXX.67): avc: denied { module_request } for pid=YYYY comm="pmdalinux" kmod="netdev-tun0" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0 allow pcp_pmcd_t kernel_t:system module_request; # type=AVC msg=audit(YYY.83): avc: denied { execute } for pid=19060 comm="zimbraprobe" name="su" dev="dm-0" ino=26416761 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:su_exec_t:s0 tclass=file permissive=0 #pmdazimbra allow pcp_pmcd_t su_exec_t:file { execute }; #============= pcp_pmlogger_t ============== #type=AVC msg=audit(XXX.44): avc: denied { open write } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:kmsg_device_t:s0 tclass=chr_file permissive=0 allow pcp_pmlogger_t kmsg_device_t:chr_file { open write }; # type=AVC msg=audit(YYY.43): avc: denied { sys_ptrace } for pid=21962 comm="ps" capability=19 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:system_r:pcp_pmlogger_t:s0 tclass=capability #type=AVC msg=audit(XXX.45): avc: denied { kill } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:pcp_pmlogger_t:s0 tclass=capability permissive=0 allow pcp_pmlogger_t self:capability { sys_ptrace fowner fsetid kill }; ## type=AVC msg=audit(YYY.44) : avc: denied { signal } for pid=28414 comm=pmsignal scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process allow pcp_pmlogger_t unconfined_t:process signal; ## type=AVC msg=audit(YYY.85): avc: denied { signal } for pid=31205 comm="pmsignal" scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process permissive=0 allow pcp_pmlogger_t unconfined_service_t:process signal; #type=AVC msg=audit(XXX.68): avc: denied { setattr unlink } for pid=29153 comm="mv" name="pmlogger_check.log" dev="dm-0" ino=926794 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=0 allow pcp_pmlogger_t user_tmp_t:file { setattr unlink }; #type=AVC msg=audit(XXX.72): avc: denied { execute } for pid=9634 comm="pmlogger_daily" name="setfiles" dev="dm-0" ino=34500334 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:setfiles_exec_t:s0 tclass=file permissive=0 allow pcp_pmlogger_t setfiles_exec_t:file execute; #============= pcp_pmie_t ============== #type=AVC msg=audit(XXX.49): avc: denied { execute execute_no_trans getattr open read } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file permissive=0 allow pcp_pmie_t hostname_exec_t:file { execute execute_no_trans getattr open read map }; #type=AVC msg=audit(YYY.50): avc: denied { sys_ptrace } for pid=30881 comm="ps" capability=19 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:system_r:pcp_pmie_t:s0 tclass=capability permissive=0 allow pcp_pmie_t self:capability { chown fowner dac_override kill net_admin sys_ptrace }; #RHBZ1517656 #type=AVC msg=audit(XXX.50): avc: denied { read } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file permissive=0 allow pcp_pmie_t proc_net_t:file read; #RHBZ1635394 #type=AVC msg=audit(YYY.66): avc: denied { sys_ptrace } for pid=15683 comm="ps" capability=19 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:system_r:pcp_pmie_t:s0 tclass=cap_userns permissive=0 allow pcp_pmie_t self:cap_userns sys_ptrace; #RHBZ1623988 #type=AVC msg=audit(YYY.65): avc: denied { signal } for pid=3106 comm="pmsignal" scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=1 allow pcp_pmie_t unconfined_t:process signal; ## type=AVC msg=audit(YYY.86): avc: denied { signal } for pid=23951 comm="pmsignal" scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process permissive=0 allow pcp_pmie_t unconfined_service_t:process signal; #============= pmda-lio ============== #type=AVC msg=audit(XXX.55): avc: denied { open read search write } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:configfs_t:s0 tclass=dir permissive=0 allow pcp_pmcd_t configfs_t:dir { open read search write }; #type=AVC msg=audit(XXX.56): avc: denied { getattr ioctl open read } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:configfs_t:s0 tclass=file permissive=0 allow pcp_pmcd_t configfs_t:file { getattr ioctl open read }; #type=AVC msg=audit(XXX.57): avc: denied { getattr read } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:configfs_t:s0 tclass=lnk_file permissive=0 allow pcp_pmcd_t configfs_t:lnk_file { getattr read }; #type=AVC msg=audit(XXX.58): avc: denied { execute execute_no_trans getattr open read } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=0 allow pcp_pmcd_t ldconfig_exec_t:file { execute execute_no_trans getattr open read }; #============= pcp_pmproxy_t ============== #type=AVC msg=audit(YYY.67) : avc: denied { net_admin } for pid=6669 comm=pmproxy capability=net_admin scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:system_r:pcp_pmproxy_t:s0 tclass=capability allow pcp_pmproxy_t self:capability { net_admin dac_override }; #type=AVC msg=audit(YYY.68) : avc: denied { read } for pid=6669 comm=pmproxy name=disable_ipv6 dev="proc" ino=9994 scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file #type=AVC msg=audit(YYY.69) : avc: denied { open } for pid=9669 comm=pmproxy path=/proc/sys/net/ipv6/conf/all/disable_ipv6 dev="proc" ino=9994 scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file #type=AVC msg=audit(YYY.70) : avc: denied { getattr } for pid=9669 comm=pmproxy path=/proc/sys/net/ipv6/conf/all/disable_ipv6 dev="proc" ino=9994 scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file allow pcp_pmproxy_t sysctl_net_t:file { getattr open read }; #type=AVC msg=audit(YYY.72): avc: denied { read } for pid=28833 comm="pmproxy" name="unix" dev="proc" ino=4026532015 scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file #RHBZ1517656 allow pcp_pmproxy_t proc_net_t:file read; #============= pcp_pmmgr_t ============== #type=AVC msg=audit(YYY.73): avc: denied { name_bind } for pid=13114 comm="pmlogger" src=4332 scontext=system_u:system_r:pcp_pmmgr_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0 allow pcp_pmmgr_t unreserved_port_t:tcp_socket name_bind; #type=AVC msg=audit(XXX.64): avc: denied { execute execute_no_trans open read getattr } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmmgr_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=0 allow pcp_pmmgr_t ldconfig_exec_t:file { execute execute_no_trans open read getattr }; #type=AVC msg=audit(XXX.69): avc: denied { dac_override } for pid=3767 comm="pmmgr" capability=1 scontext=system_u:system_r:pcp_pmmgr_t:s0 tcontext=system_u:system_r:pcp_pmmgr_t:s0 tclass=capability permissive=0 allow pcp_pmmgr_t self:capability dac_override; #============= pmda-smart ============== #type=AVC msg=audit(YYY.75): avc: denied { read } for pid=8678 comm="sh" name="smartctl" dev="dm-1" ino=2249815 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1 #type=AVC msg=audit(YYY.76): avc: denied { open } for pid=8678 comm="sh" path="/usr/sbin/smartctl" dev="dm-1" ino=2249815 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1 #type=AVC msg=audit(YYY.77): avc: denied { execute_no_trans } for pid=8678 comm="sh" path="/usr/sbin/smartctl" dev="dm-1" ino=2249815 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1 #type=AVC msg=audit(YYY.78): avc: denied { execute } for pid=8678 comm="sh" name="smartctl" dev="dm-1" ino=2249815 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1 #type=AVC msg=audit(YYY.79): avc: denied { getattr } for pid=4770 comm="sh" path="/usr/sbin/smartctl" dev="dm-1" ino=2249815 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1 #type=AVC msg=audit(YYY.80): avc: denied { map } for pid=8678 comm="smartctl" path="/usr/sbin/smartctl" dev="dm-1" ino=2249815 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1 #type=AVC msg=audit(YYY.81): avc: denied { sys_rawio } for pid=8678 comm="smartctl" capability=17 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability permissive=1 allow pcp_pmcd_t fsadm_exec_t:file { execute execute_no_trans getattr open read map }; #============= pmda-nvidia ============== #type=AVC msg=audit(YYY.83): avc: denied { map } for pid=7034 comm="pmdanvidia" path="/usr/lib64/libnvidia-ml.so" dev="dm-2" ino=16267329 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file permissive=0 #type=AVC msg=audit(YYY.84): avc: denied { execute } for pid=19828 comm="pmdanvidia" path="//usr/lib64/libnvidia-ml.so" dev="dm-2" ino=16267329 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file permissive=0 allow pcp_pmcd_t default_t:file { map execute }; #type=AVC msg=audit(XXX.66): avc: denied { sys_rawio } for pid=YYYY comm="pmdaX" name="/" dev="tracefs" ino=1 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmcd_t:s0 tclass=capability permissive=0 allow pcp_pmcd_t self:capability sys_rawio; #============= pmda-rpm ============== #type=AVC msg=audit(YYY.89): avc: denied { map } for pid=4969 comm="pmdarpm" path="/var/lib/rpm/Name" dev="dm-0" ino=519186 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file permissive=0 #============= pmda-libvirt ============== #type=AVC msg=audit(YYY.90): avc: denied { write } for pid=30922 comm="python3" name="libvirt-sock-ro" dev="tmpfs" ino=25845 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=sock_file permissive=0 # permit pcp_pmcd_t domain to read all dirs,files and fifo_file in attribute file_type files_list_non_auth_dirs(pcp_domain) files_read_all_files(pcp_pmcd_t) files_read_all_files(pcp_pmie_t) files_read_all_files(pcp_pmlogger_t) files_read_all_files(pcp_pmmgr_t) files_read_all_files(pcp_pmproxy_t) files_read_all_files(pcp_pmwebd_t) allow pcp_domain file_type:fifo_file read_fifo_file_perms; # permit pcp_pmcd_t domain to read shared memory and semaphores of all domain on system allow pcp_domain domain:shm r_sem_perms; allow pcp_domain domain:sem r_shm_perms; allow pcp_domain userdomain:shm r_sem_perms; allow pcp_domain userdomain:sem r_shm_perms; # permit pcp_domain stream connect to all domains allow pcp_domain domain:unix_stream_socket connectto; # permit pcp_domain to connect to all ports. corenet_tcp_connect_all_ports(pcp_domain) # all pcp_domain read access to all maps
修改文件时间
将文件时间修改为当前时间的前一年
删除文件