[CentOS] SELinux is preventing /usr/bin/chcon "mac_admin" access

Tue Dec 20 14:44:32 UTC 2011
James B. Byrne <byrnejb at harte-lyne.ca>

CentOS-6.1 KVM guest on CentOS-6.1 host.

I am seeing this SEAlert in the /var/log/audit/audit.log
file a new guest immediately after startup. Can someone
tell me what it means and what I should do about it?  A
Google search reveals a number of Fedora issues with
similar errors dating back a few years; most of which seem
to have something to do with package ownership.

This guest starts without activating any Ethernet i/f if
that has any bearing on the matter.

# sealert -a /var/log/audit/audit.log | more
found 1 alerts in /var/log/audit/audit.log


SELinux is preventing /usr/bin/chcon "mac_admin" access .

Detailed Description:

SELinux denied access requested by chcon. It is not
expected that this access is required by chcon and this
access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this
access - see FAQ
Please file a bug report.

Additional Information:

Source Context                system_u:system_r:initrc_t:s0
Target Context                system_u:system_r:initrc_t:s0
Target Objects                None [ capability2 ]
Source                        chcon
Source Path                   /usr/bin/chcon
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           coreutils-8.4-13.el6
Target RPM Packages
Policy RPM                   
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                    
Platform                      Linux
#1 SMP Tue Nov 22
                              19:48:09 GMT 2011 x86_64 x86_64
Alert Count                   1
First Seen                    Tue Dec 20 09:16:12 2011
Last Seen                     Tue Dec 20 09:16:12 2011
Local ID                     
Line Numbers                  10, 11

Raw Audit Messages

type=AVC msg=audit(1324390572.917:12): avc:  denied  {
mac_admin } for  pid=1443 comm="chcon" capability=33
scontext=system_u:system_r:initrc_t:s0 tcontext=sys
tem_u:system_r:initrc_t:s0 tclass=capability2

type=SYSCALL msg=audit(1324390572.917:12): arch=c000003e
syscall=188 success=no exit=-22 a0=d281c0 a1=7f02f81e8259
a2=d29580 a3=20 items=0 ppid=1442 pid=1443 auid=4294967295
uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) ses=4294967295 comm="chcon"
exe="/usr/bin/chcon" subj=system_u:system_r:initrc_t:s0

***          E-Mail is NOT a SECURE channel          ***
James B. Byrne                mailto:ByrneJB at Harte-Lyne.ca
Harte & Lyne Limited          http://www.harte-lyne.ca
9 Brockley Drive              vox: +1 905 561 1241
Hamilton, Ontario             fax: +1 905 561 0757
Canada  L8E 3C3