No AVCs written to /var/log/messages

No AVCs written to /var/log/messages

[Kim Lawson-Jenkins]

[-- Attachment #1: Type: text/plain, Size: 634 bytes --]

Hi,

 

I'm working on an embedded system using SELinux.  The audit daemon is not
running so AVC errors should be written to /var/log/messages.  SELinux is
running in permissive mode and during a system reboot I see a few AVC errors
written to a console.  However when I look in /var/log/messages there are no
AVC errors.  I haven't seen a similar problem reported in the past.  Does
anyone have any ideas why AVC errors would not be written to
/var/log/messages if the audit daemon is not running?  I've checked
syslog.conf and all messages with a priority of warning and above should be
written to /var/log/messages.

 

Kim

 

 


[-- Attachment #2: Type: text/html, Size: 2434 bytes --]

Re: No AVCs written to /var/log/messages

[Stephen Smalley]

On 05/06/2014 10:04 AM, Kim Lawson-Jenkins wrote:
> Hi,
> 
>  
> 
> I’m working on an embedded system using SELinux.  The audit daemon is
> not running so AVC errors should be written to /var/log/messages. 
> SELinux is running in permissive mode and during a system reboot I see a
> few AVC errors written to a console.  However when I look in
> /var/log/messages there are no AVC errors.  I haven’t seen a similar
> problem reported in the past.  Does anyone have any ideas why AVC errors
> would not be written to /var/log/messages if the audit daemon is not
> running?  I’ve checked syslog.conf and all messages with a priority of
> warning and above should be written to /var/log/messages.

Do they show up in dmesg output (or if you cat /proc/kmsg)?

RE: No AVCs written to /var/log/messages

[Kim Lawson-Jenkins]

I just used the command

dmesg | grep -i avc

There were 2 errors generated when I used the command; these AVC errors were
written to the console and in the dmesg output.  These were the only AVCs
recorded in the dmesg output.  The few errors that I would see during system
initialization are not in the dmesg output.


-----Original Message-----
From: Stephen Smalley [mailto:sds@tycho.nsa.gov] 
Sent: Tuesday, May 06, 2014 10:11 AM
To: kim.lawson-jenkins@nrl.navy.mil; selinux@tycho.nsa.gov
Subject: Re: No AVCs written to /var/log/messages

On 05/06/2014 10:04 AM, Kim Lawson-Jenkins wrote:
> Hi,
> 
>  
> 
> I'm working on an embedded system using SELinux.  The audit daemon is 
> not running so AVC errors should be written to /var/log/messages.
> SELinux is running in permissive mode and during a system reboot I see 
> a few AVC errors written to a console.  However when I look in 
> /var/log/messages there are no AVC errors.  I haven't seen a similar 
> problem reported in the past.  Does anyone have any ideas why AVC 
> errors would not be written to /var/log/messages if the audit daemon 
> is not running?  I've checked syslog.conf and all messages with a 
> priority of warning and above should be written to /var/log/messages.

Do they show up in dmesg output (or if you cat /proc/kmsg)?

Re: No AVCs written to /var/log/messages

[Eric Paris]

Two possible things.

1) in permissive you only get the same denial one time.  So if you
launch a program and it causes some denials, the second time you
launch it there will be no denials.

2) If they are early in boot, before syslog starts, they might be
lost, or in old machines there was a /var/log/dmesg...

Do you see the denials when you run the dmesg command?

On Tue, May 6, 2014 at 10:04 AM, Kim Lawson-Jenkins
<kim.lawson-jenkins@nrl.navy.mil> wrote:
> Hi,
>
>
>
> I’m working on an embedded system using SELinux.  The audit daemon is not
> running so AVC errors should be written to /var/log/messages.  SELinux is
> running in permissive mode and during a system reboot I see a few AVC errors
> written to a console.  However when I look in /var/log/messages there are no
> AVC errors.  I haven’t seen a similar problem reported in the past.  Does
> anyone have any ideas why AVC errors would not be written to
> /var/log/messages if the audit daemon is not running?  I’ve checked
> syslog.conf and all messages with a priority of warning and above should be
> written to /var/log/messages.
>
>
>
> Kim
>
>
>
>
>
>
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to
> Selinux-request@tycho.nsa.gov.