using delorian installed via packstack --allinone I noticed that if we restart neutron-server it generates a number of AVCs for getattr on 87 files
neutron==7.0.0.0b4.dev223
sample of a few entries from /var/log/audit.log from centos 7
type=AVC msg=audit(1442855709.922:10594): avc: denied { getattr } for pid=16273 comm="neutron-server" path="/usr/bin/hostname" dev="dm-0" ino=67231056 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
type=AVC msg=audit(1442855709.922:10595): avc: denied { getattr } for pid=16273 comm="neutron-server" path="/usr/bin/fusermount" dev="dm-0" ino=70253714 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:fusermount_exec_t:s0 tclass=file
type=AVC msg=audit(1442855709.922:10596): avc: denied { getattr } for pid=16273 comm="neutron-server" path="/usr/bin/glance-api" dev="dm-0" ino=69439463 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:glance_api_exec_t:s0 tclass=file
type=AVC msg=audit(1442855709.922:10597): avc: denied { getattr } for pid=16273 comm="neutron-server" path="/usr/bin/glance-registry" dev="dm-0" ino=69439474 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:glance_registry_exec_t:s0 tclass=file
type=AVC msg=audit(1442855709.923:10598): avc: denied { getattr } for pid=16273 comm="neutron-server" path="/usr/bin/glance-scrubber" dev="dm-0" ino=69439476 scontext=system_u:system_r:neutron_t:s0 tcontext=system_u:object_r:glance_scrubber_exec_t:
The question I have is - what's neutron-server doing statting a bunch of files during startup? Does it need to, or is this a child task doing it?
child task -> these are candidates for dontaudit rules
neutron needs to do this -> these are candidates for expanding neutron's permissions