SELinux log reading

Question

I have this in my /var/log/audit/audit.log: type=AVC msg=audit(1482914283.060:32738716): avc: denied { open } for pid=26216 comm="top" path="/run/utmp" dev="tmpfs" ino=14431 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file

How can I prevent this ? I do not really understand the issue it points me to.

Answer 1

Access is being denied to a program attempting to read a file due to the security context of that file. Change the context to get rid of the message.

Just guessing from the content of the entry, I would say this is not the regular top command, but some script used to display user statistics on a web page. Either that, or the source context is seriously broken.

Answer 2

Check the ps -efZ | grep (26216 for your case) from command line. If the responsible process is meaningful for you, go over it. Add some selinux rules to policy file or use booleans to skip this violation.