title: In selinux enforcing mode, startx failed. Xorg.0.log show: xf86EnableIOPorts: failed to set IOPL for I/O (Operation not permitted)
body: <p>I have a Suse 11 Sp3 system with customized Selinux policy installed and in enforcing mode.</p>
  
  <p>My kernel version is :</p>
  
  <p>uname -a</p>
  
  <p>Linux WUH1000070872 3.0.76-0.11-default #1 SMP Fri Jun 14 08:21:43 UTC 2013 (ccab990) x86_64 x86_64 x86_64 GNU/Linux</p>
  
  <p>When i run the startx, it failed and in the Xorg.0.log, it reported as following:</p>
  
  <p>xf86EnableIOPorts: failed to set IOPL for I/O (Operation not permitted)</p>
  
  <p>In the /var/log/audit/audit.log, I get the following:</p>
  
  <p>type=AVC msg=audit(1482486805.380:10): <strong>avc:  denied  { 0x20 }</strong> for  pid=6670 comm="X" capability=37  scontext=system_u:unconfined_r:unconfined_t:s0:c0 tcontext=system_u:unconfined_r:unconfined_t:s0:c0 tclass=capability2</p>
  
  <p>But actually some rules are there:</p>
  
  <p>sesearch -s unconfined_t -t unconfined_t -ccapability2 --allow</p>
  
  <p>Found 2 semantic av rules:</p>
  
  <p>allow common_domain unconfined_t : capability2 { mac_override mac_admin syslog wake_alarm block_suspend audit_read } ; </p>
  
  <p>allow unconfined_t unconfined_t : capability2 { mac_override mac_admin syslog wake_alarm block_suspend audit_read } ; </p>
  
  <p>My policy is as following:</p>
  
  <p>type unconfined_t, common_domain, file_type;</p>
  
  <p>allow common_domain unconfined_t:capability2 *;</p>
  
  <p>I have granted every permission but still the access is rejected. What is the problem? And the error " avc:  denied  { 0x20 }" is comfusing, here should be a permission string instead of a number. How to fix it?</p>