It worked for some time, but something must have changed recently and it doesn't work: # layman -S * Fetching remote list,... * Remote list already up to date: http://www.gentoo.org/proj/en/overlays/repositories.xml * Last-modified: Wed, 16 Jan 2013 18:20:02 GMT * Fetch Ok * Syncing selected overlays,... * Running Git... # ( cd /var/lib/layman/hardened-development && /usr/bin/git pull ) fatal: unable to access '/root/.config/git/config': Permission denied * Failure result returned from Git * Running Git... # ( cd /var/lib/layman/x11 && /usr/bin/git pull ) fatal: unable to access '/root/.config/git/config': Permission denied * Failure result returned from Git * * Errors: * ------ * Failed to sync overlay "hardened-development". * Error was: Syncing overlay "hardened-development" returned status 128! * db.sync() * Failed to sync overlay "x11". * Error was: Syncing overlay "x11" returned status 128! * db.sync() * * CLI: Errors occurred processing action sync_all * * Errors: * ------ * Failed to sync overlay "hardened-development". * Error was: Syncing overlay "hardened-development" returned status 128! * db.sync() * Failed to sync overlay "x11". * Error was: Syncing overlay "x11" returned status 128! * db.sync() * # ls -aZ /root/ | grep .config root:object_r:xdg_config_home_t .config # ls -aZ /root/.config | grep git # Enforcing: Jan 23 20:14:34 lain kernel: [19830.458866] type=1400 audit(1358968474.072:411): avc: denied { search } for pid=17351 comm="layman" name="root" dev="dm-0" ino=1835009 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=root:object_r:user_home_dir_t tclass=dir Jan 23 20:14:34 lain kernel: [19830.458880] type=1400 audit(1358968474.072:412): avc: denied { search } for pid=17351 comm="layman" name="root" dev="dm-0" ino=1835009 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=root:object_r:user_home_dir_t tclass=dir Jan 23 20:14:34 lain kernel: [19830.459389] type=1400 audit(1358968474.072:413): avc: denied { search } for pid=17351 comm="python" name="env.d" dev="dm-0" ino=20972123 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:etc_runtime_t tclass=dir Jan 23 20:14:34 lain kernel: [19830.459417] type=1400 audit(1358968474.072:414): avc: denied { search } for pid=17351 comm="python" name="root" dev="dm-0" ino=1835009 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=root:object_r:user_home_dir_t tclass=dir Jan 23 20:14:34 lain kernel: [19830.459427] type=1400 audit(1358968474.072:415): avc: denied { search } for pid=17351 comm="python" name="root" dev="dm-0" ino=1835009 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=root:object_r:user_home_dir_t tclass=dir Jan 23 20:14:34 lain kernel: [19830.460776] type=1400 audit(1358968474.074:416): avc: denied { search } for pid=17351 comm="python" name="root" dev="dm-0" ino=1835009 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=root:object_r:user_home_dir_t tclass=dir Jan 23 20:14:34 lain kernel: [19830.460788] type=1400 audit(1358968474.074:417): avc: denied { search } for pid=17351 comm="python" name="root" dev="dm-0" ino=1835009 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=root:object_r:user_home_dir_t tclass=dir Jan 23 20:14:34 lain kernel: [19830.527328] type=1400 audit(1358968474.140:418): avc: denied { search } for pid=17351 comm="layman" name="amade" dev="dm-0" ino=20709379 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=staff_u:object_r:user_home_dir_t tclass=dir Jan 23 20:14:34 lain kernel: [19830.527767] type=1400 audit(1358968474.141:419): avc: denied { search } for pid=17351 comm="layman" name="root" dev="dm-0" ino=1835009 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=root:object_r:user_home_dir_t tclass=dir Permissive: Jan 23 20:14:46 lain kernel: [19842.878131] type=1400 audit(1358968486.516:454): avc: denied { getattr } for pid=17394 comm="eselect" path="/home/amade" dev="dm-0" ino=20709379 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=staff_u:object_r:user_home_dir_t tclass=dir Jan 23 20:15:16 lain kernel: [19873.030481] type=1400 audit(1358968516.728:455): avc: denied { getattr } for pid=17393 comm="layman" path="/usr/bin/sandbox" dev="dm-0" ino=7357942 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_exec_t tclass=file Jan 23 20:15:16 lain kernel: [19873.030552] type=1400 audit(1358968516.728:456): avc: denied { execute } for pid=17393 comm="layman" name="sandbox" dev="dm-0" ino=7357942 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_exec_t tclass=file Jan 23 20:15:16 lain kernel: [19873.098595] type=1400 audit(1358968516.796:457): avc: denied { read } for pid=17393 comm="layman" name="make.profile" dev="dm-0" ino=20971603 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_conf_t tclass=lnk_file Jan 23 20:15:16 lain kernel: [19873.098718] type=1400 audit(1358968516.796:458): avc: denied { getattr } for pid=17393 comm="layman" path="/etc/portage/make.profile" dev="dm-0" ino=20971603 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_conf_t tclass=lnk_file Jan 23 20:15:17 lain kernel: [19873.527440] type=1400 audit(1358968517.226:459): avc: denied { getattr } for pid=17393 comm="layman" path="/var/cache/edb" dev="dm-0" ino=6553661 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_cache_t tclass=dir Jan 23 20:15:17 lain kernel: [19873.528768] type=1400 audit(1358968517.227:460): avc: denied { write } for pid=17393 comm="layman" name="dep" dev="dm-0" ino=6553662 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_cache_t tclass=dir Jan 23 20:15:17 lain kernel: [19873.530612] type=1400 audit(1358968517.229:461): avc: denied { write } for pid=17393 comm="layman" name="news" dev="dm-0" ino=6553614 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:var_lib_t tclass=dir Jan 23 20:15:17 lain kernel: [19873.530941] type=1400 audit(1358968517.229:462): avc: denied { add_name } for pid=17393 comm="layman" name=".news-hardened-dev.unread.portage_lockfile" scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:var_lib_t tclass=dir Jan 23 20:15:17 lain kernel: [19873.530987] type=1400 audit(1358968517.229:463): avc: denied { create } for pid=17393 comm="layman" name=".news-hardened-dev.unread.portage_lockfile" scontext=staff_u:sysadm_r:portage_fetch_t tcontext=staff_u:object_r:var_lib_t tclass=file Jan 23 20:15:17 lain kernel: [19873.531039] type=1400 audit(1358968517.229:464): avc: denied { read write open } for pid=17393 comm="layman" path="/var/lib/gentoo/news/.news-hardened-dev.unread.portage_lockfile" dev="dm-0" ino=6553817 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=staff_u:object_r:var_lib_t tclass=file Reproducible: Always Portage 2.1.11.48 (hardened/linux/amd64/selinux, gcc-4.6.3, glibc-2.16.0, 3.7.3-hardened x86_64) ================================================================= System uname: Linux-3.7.3-hardened-x86_64-Intel-R-_Core-TM-_i3_CPU_M_350_@_2.27GHz-with-gentoo-2.2 KiB Mem: 2999092 total, 615656 free KiB Swap: 3145724 total, 3145724 free Timestamp of tree: Wed, 23 Jan 2013 14:30:01 +0000 ld GNU ld (GNU Binutils) 2.23.1 app-shells/bash: 4.2_p42 dev-lang/python: 2.7.3-r3, 3.2.3-r2 dev-util/cmake: 2.8.10.2-r1 dev-util/pkgconfig: 0.27.1 sys-apps/baselayout: 2.2 sys-apps/openrc: 0.11.8 sys-apps/sandbox: 2.6 sys-devel/autoconf: 2.13, 2.69 sys-devel/automake: 1.11.6, 1.13.1 sys-devel/binutils: 2.23.1 sys-devel/gcc: 4.6.3 sys-devel/gcc-config: 1.8 sys-devel/libtool: 2.4.2 sys-devel/make: 3.82-r4 sys-kernel/linux-headers: 3.7 (virtual/os-headers) sys-libs/glibc: 2.16.0 Repositories: gentoo x11 hardened-dev my_local_overlay ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="* -@EULA AdobeFlash-10.3 PUEL skype-4.0.0.7-copyright google-talkplugin" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O3 -march=native -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-O3 -march=native -pipe" DISTDIR="/usr/portage/distfiles" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch protect-owned sandbox selinux sesandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://distfiles.gentoo.org" LANG="en_US.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j5" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/var/lib/layman/x11 /var/lib/layman/hardened-development /usr/local/portage" SYNC="rsync://rsync.gentoo.org/gentoo-portage" USE="X acpi alsa amd64 bash-completion berkdb bzip2 cli cracklib crypt cxx dri dvd gdbm gif gpm hardened iconv icu ipv6 jpeg jpeg2k justify mmx mng modules mp3 mudflap multilib ncurses nls nptl open_perms opengl openmp pam pax_kernel pcre png readline selinux session sse sse2 sse4_1 sse4_2 ssl ssse3 tcpd tiff unicode urandom usb v4l vaapi vdpau vim-syntax wacom xattr xft xinerama zlib zsh-completion" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en en_GB pl" PHP_TARGETS="php5-3" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_2" QEMU_SOFTMMU_TARGETS="x86_64 ppc" RUBY_TARGETS="ruby18 ruby19" USERLAND="GNU" VIDEO_CARDS="nouveau" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON
Does it suffice to add in the following? userdom_search_user_home_content(portage_fetch_t)
Still there # cat buglayman.te policy_module(buglayman , 1.0.0) require { type portage_fetch_t; } userdom_search_user_home_content(portage_fetch_t) # semodule -l | grep layman buglayman 1.0.0 # layman -S * Fetching remote list,... * Fetching new list... http://www.gentoo.org/proj/en/overlays/repositories.xml * Last-modified: Sat, 26 Jan 2013 21:30:02 GMT * Fetch Ok * Syncing selected overlays,... * Running Git... # ( cd /var/lib/layman/hardened-development && /usr/bin/git pull ) fatal: unable to access '/root/.config/git/config': Permission denied * Failure result returned from Git * Running Git... # ( cd /var/lib/layman/x11 && /usr/bin/git pull ) fatal: unable to access '/root/.config/git/config': Permission denied * Failure result returned from Git * * Errors: * ------ * Failed to sync overlay "hardened-development". * Error was: Syncing overlay "hardened-development" returned status 128! * db.sync() * Failed to sync overlay "x11". * Error was: Syncing overlay "x11" returned status 128! * db.sync() * * CLI: Errors occurred processing action sync_all * * Errors: * ------ * Failed to sync overlay "hardened-development". * Error was: Syncing overlay "hardened-development" returned status 128! * db.sync() * Failed to sync overlay "x11". * Error was: Syncing overlay "x11" returned status 128! * db.sync() * * update_news() failed running portage news reporter function * Error was; stat('/etc/portage/make.profile') Enforcing: Jan 27 14:42:54 lain kernel: [ 2769.217533] type=1400 audit(1359294174.135:166): avc: denied { search } for pid=21230 comm="python" name="env.d" dev="dm-0" ino=20972123 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:etc_runtime_t tclass=dir Jan 27 14:42:54 lain kernel: [ 2769.288373] type=1400 audit(1359294174.206:167): avc: denied { search } for pid=21230 comm="layman" name=".local" dev="dm-0" ino=6160747 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=root:object_r:xdg_data_home_t tclass=dir Jan 27 14:42:54 lain kernel: [ 2769.374797] type=1400 audit(1359294174.293:168): avc: denied { search } for pid=21230 comm="layman" name=".local" dev="dm-0" ino=6160747 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=root:object_r:xdg_data_home_t tclass=dir Jan 27 14:42:56 lain kernel: [ 2771.568740] type=1400 audit(1359294176.491:169): avc: denied { search } for pid=21245 comm="git" name=".config" dev="dm-0" ino=6160740 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=root:object_r:xdg_config_home_t tclass=dir Jan 27 14:42:56 lain kernel: [ 2771.577601] type=1400 audit(1359294176.500:170): avc: denied { search } for pid=21247 comm="git" name=".config" dev="dm-0" ino=6160740 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=root:object_r:xdg_config_home_t tclass=dir Jan 27 14:42:56 lain kernel: [ 2771.680582] type=1400 audit(1359294176.603:171): avc: denied { getattr } for pid=21230 comm="layman" path="/usr/bin/sandbox" dev="dm-0" ino=7357942 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_exec_t tclass=file Jan 27 14:42:56 lain kernel: [ 2771.753135] type=1400 audit(1359294176.676:172): avc: denied { read } for pid=21230 comm="layman" name="make.profile" dev="dm-0" ino=20971603 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_conf_t tclass=lnk_file
And with xdg_read_config_home_files(portage_fetch_t) set?
Yes, looks better # layman -S * Fetching remote list,... * Remote list already up to date: http://www.gentoo.org/proj/en/overlays/repositories.xml * Last-modified: Sat, 26 Jan 2013 21:30:02 GMT * Fetch Ok * Syncing selected overlays,... * Running Git... # ( cd /var/lib/layman/hardened-development && /usr/bin/git pull ) Already up-to-date. * Running Git... # ( cd /var/lib/layman/x11 && /usr/bin/git pull ) Already up-to-date. * * Succeeded: * ------ * Successfully synchronized overlay "hardened-development". * Successfully synchronized overlay "x11". * * CLI: Errors occurred processing action sync_all * update_news() failed running portage news reporter function * Error was; stat('/etc/portage/make.profile') # cat buglayman.te policy_module(buglayman , 1.0.0) require { type portage_fetch_t; } #userdom_search_user_home_content(portage_fetch_t) xdg_read_config_home_files(portage_fetch_t) Enforcing: Jan 27 15:01:41 lain kernel: [ 3894.259090] type=1400 audit(1359295301.410:1415): avc: denied { search } for pid=7257 comm="python" name="env.d" dev="dm-0" ino=20972123 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:etc_runtime_t tclass=dir Jan 27 15:01:41 lain kernel: [ 3894.328330] type=1400 audit(1359295301.479:1416): avc: denied { search } for pid=7257 comm="layman" name=".local" dev="dm-0" ino=6160747 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=root:object_r:xdg_data_home_t tclass=dir Jan 27 15:01:41 lain kernel: [ 3894.409290] type=1400 audit(1359295301.560:1417): avc: denied { search } for pid=7257 comm="layman" name=".local" dev="dm-0" ino=6160747 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=root:object_r:xdg_data_home_t tclass=dir Jan 27 15:01:42 lain kernel: [ 3895.455898] type=1400 audit(1359295302.609:1418): avc: denied { getattr } for pid=7257 comm="layman" path="/usr/bin/sandbox" dev="dm-0" ino=7357942 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_exec_t tclass=file Jan 27 15:01:42 lain kernel: [ 3895.528238] type=1400 audit(1359295302.681:1419): avc: denied { read } for pid=7257 comm="layman" name="make.profile" dev="dm-0" ino=20971603 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_conf_t tclass=lnk_file Permissive: Jan 27 15:02:23 lain kernel: [ 3936.073595] type=1400 audit(1359295343.307:1421): avc: denied { getattr } for pid=7365 comm="layman" path="/usr/bin/sandbox" dev="dm-0" ino=7357942 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_exec_t tclass=file Jan 27 15:02:23 lain kernel: [ 3936.073663] type=1400 audit(1359295343.307:1422): avc: denied { execute } for pid=7365 comm="layman" name="sandbox" dev="dm-0" ino=7357942 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_exec_t tclass=file Jan 27 15:02:23 lain kernel: [ 3936.140267] type=1400 audit(1359295343.374:1423): avc: denied { read } for pid=7365 comm="layman" name="make.profile" dev="dm-0" ino=20971603 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_conf_t tclass=lnk_file Jan 27 15:02:23 lain kernel: [ 3936.140388] type=1400 audit(1359295343.374:1424): avc: denied { getattr } for pid=7365 comm="layman" path="/etc/portage/make.profile" dev="dm-0" ino=20971603 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_conf_t tclass=lnk_file Jan 27 15:02:23 lain kernel: [ 3936.565012] type=1400 audit(1359295343.800:1425): avc: denied { getattr } for pid=7365 comm="layman" path="/var/cache/edb" dev="dm-0" ino=6553661 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_cache_t tclass=dir Jan 27 15:02:23 lain kernel: [ 3936.566369] type=1400 audit(1359295343.801:1426): avc: denied { write } for pid=7365 comm="layman" name="dep" dev="dm-0" ino=6553662 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_cache_t tclass=dir Jan 27 15:02:23 lain kernel: [ 3936.568207] type=1400 audit(1359295343.803:1427): avc: denied { write } for pid=7365 comm="layman" name="news" dev="dm-0" ino=6553614 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:var_lib_t tclass=dir Jan 27 15:02:23 lain kernel: [ 3936.568544] type=1400 audit(1359295343.803:1428): avc: denied { add_name } for pid=7365 comm="layman" name=".news-hardened-dev.unread.portage_lockfile" scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:var_lib_t tclass=dir Jan 27 15:02:23 lain kernel: [ 3936.568579] type=1400 audit(1359295343.803:1429): avc: denied { create } for pid=7365 comm="layman" name=".news-hardened-dev.unread.portage_lockfile" scontext=staff_u:sysadm_r:portage_fetch_t tcontext=staff_u:object_r:var_lib_t tclass=file
Add in a "portage_read_config(portage_fetch_t)" and then the last bit on the news should be resolved as well.
Works now without warnings. # cat buglayman.te policy_module(buglayman , 1.0.0) require { type portage_fetch_t; } xdg_read_config_home_files(portage_fetch_t) portage_read_config(portage_fetch_t) # layman -S * Fetching remote list,... * Remote list already up to date: http://www.gentoo.org/proj/en/overlays/repositories.xml * Last-modified: Sat, 26 Jan 2013 21:30:02 GMT * Fetch Ok * Syncing selected overlays,... * Running Git... # ( cd /var/lib/layman/hardened-development && /usr/bin/git pull ) Already up-to-date. * Running Git... # ( cd /var/lib/layman/x11 && /usr/bin/git pull ) Already up-to-date. * * Succeeded: * ------ * Successfully synchronized overlay "hardened-development". * Successfully synchronized overlay "x11". * Enforcing: Jan 28 11:41:24 lain kernel: [ 3847.300701] type=1400 audit(1359369684.093:20): avc: denied { search } for pid=5627 comm="python" name="env.d" dev="dm-0" ino=20972123 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:etc_runtime_t tclass=dir Jan 28 11:41:24 lain kernel: [ 3847.369515] type=1400 audit(1359369684.162:21): avc: denied { search } for pid=5627 comm="layman" name=".local" dev="dm-0" ino=6160747 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=root:object_r:xdg_data_home_t tclass=dir Jan 28 11:41:24 lain kernel: [ 3847.443451] type=1400 audit(1359369684.236:22): avc: denied { search } for pid=5627 comm="layman" name=".local" dev="dm-0" ino=6160747 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=root:object_r:xdg_data_home_t tclass=dir Jan 28 11:41:27 lain kernel: [ 3851.006874] type=1400 audit(1359369687.807:23): avc: denied { getattr } for pid=5627 comm="layman" path="/usr/bin/sandbox" dev="dm-0" ino=7357942 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_exec_t tclass=file Jan 28 11:41:30 lain kernel: [ 3853.808523] type=1400 audit(1359369690.614:24): avc: denied { getattr } for pid=5627 comm="layman" path="/var/cache/edb" dev="dm-0" ino=6553661 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_cache_t tclass=dir Jan 28 11:41:30 lain kernel: [ 3853.808567] type=1400 audit(1359369690.614:25): avc: denied { search } for pid=5627 comm="layman" name="edb" dev="dm-0" ino=6553661 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_cache_t tclass=dir Jan 28 11:41:30 lain kernel: [ 3853.833313] type=1400 audit(1359369690.639:26): avc: denied { getattr } for pid=5627 comm="layman" path="/var/cache/edb" dev="dm-0" ino=6553661 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_cache_t tclass=dir Jan 28 11:41:30 lain kernel: [ 3853.833450] type=1400 audit(1359369690.639:27): avc: denied { search } for pid=5627 comm="layman" name="edb" dev="dm-0" ino=6553661 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_cache_t tclass=dir Jan 28 11:41:30 lain kernel: [ 3853.833557] type=1400 audit(1359369690.639:28): avc: denied { search } for pid=5627 comm="layman" name="edb" dev="dm-0" ino=6553661 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_cache_t tclass=dir Jan 28 11:41:30 lain kernel: [ 3853.833688] type=1400 audit(1359369690.639:29): avc: denied { search } for pid=5627 comm="layman" name="edb" dev="dm-0" ino=6553661 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:portage_cache_t tclass=dir Jan 28 11:41:30 lain kernel: [ 3853.845984] type=1400 audit(1359369690.651:30): avc: denied { write } for pid=5627 comm="layman" name="news" dev="dm-0" ino=6553614 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:var_lib_t tclass=dir Jan 28 11:41:30 lain kernel: [ 3853.846726] type=1400 audit(1359369690.652:31): avc: denied { write } for pid=5627 comm="layman" name="news" dev="dm-0" ino=6553614 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:var_lib_t tclass=dir Jan 28 11:41:30 lain kernel: [ 3853.847807] type=1400 audit(1359369690.653:32): avc: denied { write } for pid=5627 comm="layman" name="news" dev="dm-0" ino=6553614 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:var_lib_t tclass=dir Jan 28 11:41:30 lain kernel: [ 3853.848359] type=1400 audit(1359369690.654:33): avc: denied { write } for pid=5627 comm="layman" name="news" dev="dm-0" ino=6553614 scontext=staff_u:sysadm_r:portage_fetch_t tcontext=system_u:object_r:var_lib_t tclass=dir
In repo and will be in rev12
r12 in main tree, ~arch'ed.
stabilized