In the CentOS7 GUI, I have been seeing a smattering of messages such as:
SELinux is preventing /usr/bin/smbd from getattr on the file ___. The files are for instance:
/etc/default/grub /etc/rc.d/init.d/webmin network.service kmsg authconfig.py modules generator /usr/bin/wodim /usr/sbin/sendmail.postfix
The machine is serving files to two Windows computers on a network and as far as I can tell, neither machine is attempting to access these admittedly important looking files.
The UI at best is giving advice on how to allow these accesses, which if this is an intrusion is a terrible idea. There is no information on the source of the requests or anything obvious with which to investigate further.
Are they just false positives?