From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from goalie.tycho.ncsc.mil (goalie [144.51.31.250]) by tarius.tycho.ncsc.mil (8.13.1/8.13.1) with ESMTP id r3HEGR1m024547 for ; Wed, 17 Apr 2013 10:16:27 -0400 Received: from iad-wprd-xchw02.corp.verio.net (iad-wprd-xchw02.corp.verio.net [198.87.7.165]) by relay1-bcrtfl2.verio.net (Postfix) with ESMTP id 6D4D8B038688 for ; Wed, 17 Apr 2013 10:16:24 -0400 (EDT) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01CE3B76.24029BE9" Subject: Not sending AVC denials to audit.log Date: Wed, 17 Apr 2013 10:16:23 -0400 Message-ID: <0971982CF6B9AB418FFD5FEF7F50CB9F05E09E0C@IAD-WPRD-XCHB03.corp.verio.net> From: "Rodney Simioni" To: Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov This is a multi-part message in MIME format. ------_=_NextPart_001_01CE3B76.24029BE9 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, =20 I have a few development tests that are failing when I put the server in 'enforcing` mode; however, it's not sending AVC denials to the audit.log. I have also used 'semanage dontaudit' in both on and off position and it's not generating denials. When I put the server in 'permissive mode`, the tests do not fail. Why isn't selinux sending the denials to the audit.log when the tests fail? How do I go about finding the culprit(s) that is/are failing my tests? Thanks in advance. =20 Rodney This email message is intended for the use of the person to whom it has = been sent, and may contain information that is confidential or legally = protected. If you are not the intended recipient or have received this = message in error, you are not authorized to copy, distribute, or = otherwise use this message or its attachments. Please notify the sender = immediately by return e-mail and permanently delete this message and any = attachments. Verio Inc. makes no warranty that this email is error or = virus free. Thank you. ------_=_NextPart_001_01CE3B76.24029BE9 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,

I have a few = development tests that are failing when I put the server in = ‘enforcing` mode; however, it’s not sending AVC denials to = the audit.log.

I have also used = ‘semanage dontaudit’ in both on and off position and = it’s not generating denials. When I put the server in = ‘permissive mode`, the tests do not fail.

Why isn’t selinux sending the denials to the = audit.log when the tests fail? How do I go about finding the culprit(s) = that is/are failing my tests? Thanks in advance.

Rodney

This email = message is intended for the use of the person to whom it has been sent, = and may contain information that is confidential or legally protected. = If you are not the intended recipient or have received this message in = error, you are not authorized to copy, distribute, or otherwise use this = message or its attachments. Please notify the sender immediately by = return e-mail and permanently delete this message and any attachments. = Verio Inc. makes no warranty that this email is error or virus free. = Thank you.

------_=_NextPart_001_01CE3B76.24029BE9-- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from goalie.tycho.ncsc.mil (goalie [144.51.31.250]) by tarius.tycho.ncsc.mil (8.13.1/8.13.1) with ESMTP id r3HEoqa7029788 for ; Wed, 17 Apr 2013 10:50:52 -0400 Received: by mail-pd0-f179.google.com with SMTP id x11so918574pdj.10 for ; Wed, 17 Apr 2013 07:50:49 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: <0971982CF6B9AB418FFD5FEF7F50CB9F05E09E0C@IAD-WPRD-XCHB03.corp.verio.net> References: <0971982CF6B9AB418FFD5FEF7F50CB9F05E09E0C@IAD-WPRD-XCHB03.corp.verio.net> Date: Wed, 17 Apr 2013 09:50:49 -0500 Message-ID: Subject: Re: Not sending AVC denials to audit.log From: Ted Toth To: Rodney Simioni Cc: SELinux Content-Type: multipart/alternative; boundary=047d7bd6c73ea0382504da8f9c64 Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov --047d7bd6c73ea0382504da8f9c64 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable You might try 'semanage -DB' to disable all of the dontaudits. Run 'semanage -B' to re-enable dontaudits. On Wed, Apr 17, 2013 at 9:16 AM, Rodney Simioni w= rote: > Hi,**** > > ** ** > > I have a few development tests that are failing when I put the server in > =91enforcing` mode; however, it=92s not sending AVC denials to the audit.= log.* > *** > > I have also used =91semanage dontaudit=92 in both on and off position and= it=92s > not generating denials. When I put the server in =91permissive mode`, the > tests do not fail.**** > > Why isn=92t selinux sending the denials to the audit.log when the tests > fail? How do I go about finding the culprit(s) that is/are failing my > tests? Thanks in advance.**** > > ** ** > > Rodney**** > > > This email message is intended for the use of the person to whom it has > been sent, and may contain information that is confidential or legally > protected. If you are not the intended recipient or have received this > message in error, you are not authorized to copy, distribute, or otherwis= e > use this message or its attachments. Please notify the sender immediately > by return e-mail and permanently delete this message and any attachments. > Verio Inc. makes no warranty that this email is error or virus free. Than= k > you. > --047d7bd6c73ea0382504da8f9c64 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: quoted-printable

You might try 'semanage -DB' to disable all of the= dontaudits. Run 'semanage -B' to re-enable dontaudits.

On Wed, Apr 17, 201= 3 at 9:16 AM, Rodney Simioni <rodney.simioni@verio.net> wrote:

Hi,
=A0

I have a few development tests that are failing when= I put the server in =91enforcing` mode; however, it=92s not sending AVC de= nials to the audit.log.
I have also= used =91semanage dontaudit=92 in both on and off position and it=92s not g= enerating denials. When I put the server in =91permissive mode`, the tests = do not fail.

Why isn=92t selinux sending the denials to the audit= .log when the tests fail? How do I go about finding the culprit(s) that is/= are failing my tests? Thanks in advance.
=A0
Rodney
<= p>

This email message is intended for the use of the person to wh= om it has been sent, and may contain information that is confidential or le= gally protected. If you are not the intended recipient or have received thi= s message in error, you are not authorized to copy, distribute, or otherwis= e use this message or its attachments. Please notify the sender immediately= by return e-mail and permanently delete this message and any attachments. = Verio Inc. makes no warranty that this email is error or virus free. Thank= you.

--047d7bd6c73ea0382504da8f9c64-- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from goalie.tycho.ncsc.mil (goalie [144.51.31.250]) by tarius.tycho.ncsc.mil (8.13.1/8.13.1) with ESMTP id r3HGt1Z4007896 for ; Wed, 17 Apr 2013 12:55:01 -0400 Received: by mail-ee0-f48.google.com with SMTP id b15so881166eek.21 for ; Wed, 17 Apr 2013 09:54:57 -0700 (PDT) Message-ID: <1366217693.2803.53.camel@x220.localdomain> Subject: Re: Not sending AVC denials to audit.log From: Dominick Grift To: Rodney Simioni Cc: selinux@tycho.nsa.gov Date: Wed, 17 Apr 2013 18:54:53 +0200 In-Reply-To: <0971982CF6B9AB418FFD5FEF7F50CB9F05E09E0C@IAD-WPRD-XCHB03.corp.verio.net> References: <0971982CF6B9AB418FFD5FEF7F50CB9F05E09E0C@IAD-WPRD-XCHB03.corp.verio.net> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov On Wed, 2013-04-17 at 10:16 -0400, Rodney Simioni wrote: > Hi, > > > > I have a few development tests that are failing when I put the server > in ‘enforcing` mode; however, it’s not sending AVC denials to the > audit.log. Is auditd running? -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from goalie.tycho.ncsc.mil (goalie [144.51.31.250]) by tarius.tycho.ncsc.mil (8.13.1/8.13.1) with ESMTP id r3HHxXA9006247 for ; Wed, 17 Apr 2013 13:59:37 -0400 Message-ID: <516EE305.3090103@redhat.com> Date: Wed, 17 Apr 2013 13:59:33 -0400 From: Daniel J Walsh MIME-Version: 1.0 To: Dominick Grift CC: Rodney Simioni , selinux@tycho.nsa.gov Subject: Re: Not sending AVC denials to audit.log References: <0971982CF6B9AB418FFD5FEF7F50CB9F05E09E0C@IAD-WPRD-XCHB03.corp.verio.net> <1366217693.2803.53.camel@x220.localdomain> In-Reply-To: <1366217693.2803.53.camel@x220.localdomain> Content-Type: text/plain; charset=UTF-8 Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/17/2013 12:54 PM, Dominick Grift wrote: > On Wed, 2013-04-17 at 10:16 -0400, Rodney Simioni wrote: >> Hi, >> >> >> >> I have a few development tests that are failing when I put the server in >> ‘enforcing` mode; however, it’s not sending AVC denials to the >> audit.log. > > Is auditd running? > > > > -- This message was distributed to subscribers of the selinux mailing > list. If you no longer wish to subscribe, send mail to > majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes > as the message. > If auditd is not running avc messages go to /var/log/messages -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlFu4wQACgkQrlYvE4MpobP8egCgiWm+Abv9mmbHlqM/V2DEIFQF SCUAnRKAevSILVzWjLBjv6N/p8ynH/F8 =l1H4 -----END PGP SIGNATURE----- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.