All of lore.kernel.org
 help / color / mirror / Atom feed
From: Daniel J Walsh <dwalsh@redhat.com>
To: Stephen Smalley <sds@tycho.nsa.gov>
Cc: linux-audit@redhat.com, "Göran Uddeborg" <goeran@uddeborg.se>,
	selinux@lists.fedoraproject.org
Subject: Re: How do I figure out on what file dac_override is attempted?
Date: Wed, 20 Jan 2010 10:12:56 -0500	[thread overview]
Message-ID: <4B571D78.3060000@redhat.com> (raw)
In-Reply-To: <1263995482.24133.26.camel@moss-pluto.epoch.ncsc.mil>

On 01/20/2010 08:51 AM, Stephen Smalley wrote:
> On Wed, 2010-01-20 at 13:47 +0100, Göran Uddeborg wrote:
>> Stephen Smalley:
>>> To get object information, you need to enable
>>> syscall auditing, and add a trivial syscall filter to turn on pathname
>>> collection by the audit subsystem.
>>
>> Thanks for that tip (all of you who gave it)!  I now know it is
>> /dev/fb that plymouthd can't access.  The audit record also told me it
>> was owned by a regular user and mode rw-------.  So now it makes
>> sense.  A root process would need dac_override to open that file.
> 
> That tip really ought to get captured in the Fedora SELinux FAQ or
> Guide.  Dan?
> 

You mean turning on full auditing if you have a suspicious DAC_OVERRIDE?

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

  parent reply	other threads:[~2010-01-20 15:12 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <19284.52512.295295.185383@gargle.gargle.HOWL>
2010-01-19 14:52 ` How do I figure out on what file dac_override is attempted? Stephen Smalley
     [not found] ` <1263912766.12068.12.camel@moss-pluto.epoch.ncsc.mil>
2010-01-19 15:06   ` Daniel J Walsh
     [not found]   ` <4B55CA8B.3030706@redhat.com>
2010-01-19 15:23     ` Stephen Smalley
     [not found]   ` <19286.64383.173222.447312@gargle.gargle.HOWL>
2010-01-20 13:51     ` Stephen Smalley
     [not found]     ` <1263995482.24133.26.camel@moss-pluto.epoch.ncsc.mil>
2010-01-20 15:12       ` Daniel J Walsh [this message]
2010-01-20 15:22         ` Stephen Smalley
     [not found]         ` <1264000927.24133.93.camel@moss-pluto.epoch.ncsc.mil>
     [not found]           ` <4B572C29.8050600@manicmethod.com>
2010-01-20 19:23             ` Daniel J Walsh
     [not found]             ` <4B57582D.7070904@redhat.com>
2010-01-20 19:50               ` Stephen Smalley
     [not found]               ` <1264017052.24133.161.camel@moss-pluto.epoch.ncsc.mil>
2010-01-20 20:13                 ` Steve Grubb
2010-01-20 20:49                 ` Daniel J Walsh
     [not found]                 ` <4B576C58.3090801@redhat.com>
2010-01-20 20:57                   ` Stephen Smalley

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4B571D78.3060000@redhat.com \
    --to=dwalsh@redhat.com \
    --cc=goeran@uddeborg.se \
    --cc=linux-audit@redhat.com \
    --cc=sds@tycho.nsa.gov \
    --cc=selinux@lists.fedoraproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.