* anyway to reverse a dontaudit rule?
@ 2006-11-15 18:47 Joy Latten
2006-11-15 22:06 ` Karl MacMillan
0 siblings, 1 reply; 4+ messages in thread
From: Joy Latten @ 2006-11-15 18:47 UTC (permalink / raw)
To: redhat-lspp, selinux
Is there a way to reverse a dontaudit rule without having to
modify and recompile base policy?
I need to see the audit message to help determine what permissions
are being denied for a particular application.
Regards,
Joy
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: anyway to reverse a dontaudit rule?
2006-11-15 18:47 anyway to reverse a dontaudit rule? Joy Latten
@ 2006-11-15 22:06 ` Karl MacMillan
2006-11-16 14:05 ` [redhat-lspp] " Christopher J. PeBenito
2006-11-20 18:59 ` Stephen Smalley
0 siblings, 2 replies; 4+ messages in thread
From: Karl MacMillan @ 2006-11-15 22:06 UTC (permalink / raw)
To: Joy Latten; +Cc: redhat-lspp, selinux
Joy Latten wrote:
> Is there a way to reverse a dontaudit rule without having to
> modify and recompile base policy?
> I need to see the audit message to help determine what permissions
> are being denied for a particular application.
>
No - that is why the enableaudit.pp base policy is provided in
/usr/share/selinux/[policyname]/enableaudit.pp. Install that with:
semodule -b path_to_enableaudit
and you should see all denials.
Karl
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [redhat-lspp] Re: anyway to reverse a dontaudit rule?
2006-11-15 22:06 ` Karl MacMillan
@ 2006-11-16 14:05 ` Christopher J. PeBenito
2006-11-20 18:59 ` Stephen Smalley
1 sibling, 0 replies; 4+ messages in thread
From: Christopher J. PeBenito @ 2006-11-16 14:05 UTC (permalink / raw)
To: Karl MacMillan; +Cc: Joy Latten, redhat-lspp, selinux
On Wed, 2006-11-15 at 17:06 -0500, Karl MacMillan wrote:
> Joy Latten wrote:
> > Is there a way to reverse a dontaudit rule without having to
> > modify and recompile base policy?
> > I need to see the audit message to help determine what permissions
> > are being denied for a particular application.
> >
>
> No - that is why the enableaudit.pp base policy is provided in
> /usr/share/selinux/[policyname]/enableaudit.pp. Install that with:
>
> semodule -b path_to_enableaudit
>
> and you should see all denials.
Yes. Eventually all of the dontaudits will be made conditional,
controlled by a Boolean.
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: anyway to reverse a dontaudit rule?
2006-11-15 22:06 ` Karl MacMillan
2006-11-16 14:05 ` [redhat-lspp] " Christopher J. PeBenito
@ 2006-11-20 18:59 ` Stephen Smalley
1 sibling, 0 replies; 4+ messages in thread
From: Stephen Smalley @ 2006-11-20 18:59 UTC (permalink / raw)
To: Karl MacMillan; +Cc: Joy Latten, redhat-lspp, selinux
On Wed, 2006-11-15 at 17:06 -0500, Karl MacMillan wrote:
> Joy Latten wrote:
> > Is there a way to reverse a dontaudit rule without having to
> > modify and recompile base policy?
> > I need to see the audit message to help determine what permissions
> > are being denied for a particular application.
> >
>
> No - that is why the enableaudit.pp base policy is provided in
> /usr/share/selinux/[policyname]/enableaudit.pp. Install that with:
>
> semodule -b path_to_enableaudit
>
> and you should see all denials.
...that would have been suppressed by dontaudit rules in the base
module. But not dontaudit rules in non-base modules.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2006-11-20 18:59 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-11-15 18:47 anyway to reverse a dontaudit rule? Joy Latten
2006-11-15 22:06 ` Karl MacMillan
2006-11-16 14:05 ` [redhat-lspp] " Christopher J. PeBenito
2006-11-20 18:59 ` Stephen Smalley
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.