From: Petr Lautrbach <plautrba@redhat.com>
To: selinux@vger.kernel.org
Cc: Chris PeBenito <chpebeni@linux.microsoft.com>
Subject: Re: Userspace AVC auditing on policy load
Date: Wed, 26 Aug 2020 16:16:19 +0200 [thread overview]
Message-ID: <20200826141619.GC401602@workstation> (raw)
In-Reply-To: <cb7451da-24d3-4a0c-e4f8-205e6539ed54@linux.microsoft.com>
[-- Attachment #1: Type: text/plain, Size: 1224 bytes --]
On Wed, Aug 26, 2020 at 09:25:18AM -0400, Chris PeBenito wrote:
> I was looking into this dbus-broker audit message, which has the wrong audit type:
>
> audit[422]: USER_AVC pid=422 uid=999 auid=4294967295 ses=4294967295
> subj=system_u:system_r:system_dbusd_t msg='avc: received policyload notice
> (seqno=2)
>
> This is due to dbus-broker setting their avc log callback to send USER_AVC
> audit messages for everything that comes to the libselinux log callback. I
> think the right thing to do there is to change it to emit USER_SELINUX_ERR
> audit messages if the log message is SELINUX_ERROR, otherwise log the
> message using their regular method (stderr I think).
Similar problem existed in systemd. It was fixed by the following commit
https://github.com/systemd/systemd/commit/6227fc14c48c4c17daed4b91f61cdd4aa375790a
which lets systemd log callback to ignore everything but SELINUX_AVC and SELINUX_ERR
I believe this is the same problem which should be fixed in dbus and dbus-broker
> But the question became, why is the userspace AVC not simply emitting its
> own USER_MAC_POLICY_LOAD audit message instead of sending a message to the
> log callback?
>
> --
> Chris PeBenito
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
next prev parent reply other threads:[~2020-08-26 14:16 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-26 13:25 Userspace AVC auditing on policy load Chris PeBenito
2020-08-26 13:42 ` Stephen Smalley
2020-08-26 14:06 ` Chris PeBenito
2020-08-26 14:46 ` Stephen Smalley
2020-08-26 14:50 ` Chris PeBenito
2020-08-26 18:28 ` Chris PeBenito
2020-08-26 18:51 ` Stephen Smalley
2020-08-26 19:07 ` Dominick Grift
2020-08-26 19:15 ` Chris PeBenito
2020-08-26 19:27 ` Dominick Grift
2020-08-26 14:16 ` Petr Lautrbach [this message]
-- strict thread matches above, loose matches on Subject: below --
2020-08-27 15:47 Richard Haines
2020-08-27 15:54 ` Dominick Grift
2020-08-27 16:38 ` Dominick Grift
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200826141619.GC401602@workstation \
--to=plautrba@redhat.com \
--cc=chpebeni@linux.microsoft.com \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.