AVC found in the audit log regarding "fapolicyd_t" and "rpm_var_lib_t" SELinux types

Solution Verified - Updated -

Issue

  • Checking the audit log, we can see an AVC related to fapolicyd service attempting to create a RPM database lock file

    type=SYSCALL ... syscall=257 success=no exit=-13 ... ppid=1 pid=PID ... comm="fapolicyd" exe="/usr/sbin/fapolicyd" subj=system_u:system_r:fapolicyd_t:s0 ...
type=AVC ...: avc:  denied  { write } for  pid=PID comm="fapolicyd" name="rpm" ... scontext=system_u:system_r:fapolicyd_t:s0 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=dir permissive=0

    The AVC may also be seen for add_name operation instead of write operation.

  • fapolicyd service seems functional anyway

Environment

  • Red Hat Enterprise Linux 8
    • fapolicyd
    • selinux

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content