Re: audit 1.2.2 released

[Steve Grubb <sgrubb@redhat.com>]

On Tuesday 16 May 2006 10:53, Michael C Thompson wrote:
> > [ resulting log activity:
> > type=AVC msg=audit(1147657744.953:39): avc:  denied  { nlmsg_readpriv }
> > for  pid=2091 comm="auditctl"
> > scontext=root:staff_r:staff_t:s0-s15:c0.c255
> > tcontext=root:staff_r:staff_t:s0-s15:c0.c255 tclass=netlink_audit_socket
> > type=SYSCALL msg=audit(1147657744.953:39): arch=40000003 syscall=102
> > success=yes exit=16 a0=b a1=bfad2760 a2=805b0f8 a3=10 items=0 ppid=2067
> > pid=2091 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
> > tty=pts1 comm="auditctl" exe="/sbin/auditctl"
> > subj=root:staff_r:staff_t:s0-s15:c0.c255
> > type=SOCKADDR msg=audit(1147657744.953:39):
> > saddr=100000000000000000000000 type=SOCKETCALL
> > msg=audit(1147657744.953:39): nargs=6 a0=3 a1=bfad69fc a2=10 a3=0
> > a4=bfad2790 a5=c
> > ]

I missed this. This is the smoking gun...why did SE Linux reject the syscall? 
Next time, SE Linux was OK and allowed access. I wonder if this points to an 
avc caching problem since subsequent attempts is just fine.

-Steve