Re: audit collector startup help

[LC Bruzenak <lenny@magitekltd.com>]

On Tue, 2008-09-09 at 18:07 -0400, DJ Delorie wrote:
> > Only thing I did in between was load about 100 packages needed for the
> > rebuild. Is there any chance that one of these had some necessary magic
> > I was missing?
> 
> More likely, something was holding the socket in CLOSE_WAIT or
> something and happened to time out while you were updating everything.

Actually I believe one of the packages must installed my policy as
enforcing.

Thanks(!) to an excellent setroubleshoot pop-up I believe that was my
problem:

Source Context:  unconfined_u:system_r:auditd_t:s0
Target Context:  system_u:object_r:anon_inodefs_t:s0
Target Objects:  anon_inode [ file ]
Source:  auditdSource 
Path:  /sbin/auditd
Port:  <Unknown>
Host:  fryspc
Source RPM Packages:  audit-1.7.5-1.fc9
Target RPM Packages:  
Policy RPM:  selinux-policy-3.3.1-87.fc9
Selinux Enabled:  True
Policy Type:  targeted
MLS Enabled:  True
Enforcing Mode:  Enforcing
Plugin Name:  catchall_file
Host Name:  fryspc
Platform:  Linux fryspc 2.6.26.3-29.fc9.i686 #1 SMP Wed Sep 3 03:42:27 EDT 2008 i686 athlon
Alert Count:  1
First Seen:  Thu 11 Sep 2008 10:08:57 AM CDT
Last Seen:  Thu 11 Sep 2008 10:08:57 AM CDT
Local ID:  8b4ff486-ae1c-4448-bf38-9b56658ebc01
Line Numbers:  
Raw Audit Messages :
host=fryspc type=AVC msg=audit(1221145737.208:55): avc: denied { write } for pid=3280 comm="auditd" path="anon_inode:[eventfd]" dev=anon_inodefs ino=18 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=system_u:object_r:anon_inodefs_t:s0 tclass=file 
host=fryspc type=SYSCALL msg=audit(1221145737.208:55): arch=40000003 syscall=4 success=no exit=-13 a0=8 a1=bfb98880 a2=8 a3=b7f6aab8 items=0 ppid=1 pid=3280 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="auditd" exe="/sbin/auditd" subj=unconfined_u:system_r:auditd_t:s0 key=(null) 

### note: I do not have an MLS policy on this machine (although the
setroubleshoot summary says I do) - and I didn't change any policy
defaults.

[lenny@fryspc ~]$ rpm -qa | grep policy
checkpolicy-2.0.16-3.fc9.i386
policycoreutils-2.0.52-8.fc9.i386
selinux-policy-targeted-3.3.1-87.fc9.noarch
selinux-policy-devel-3.3.1-87.fc9.noarch
policycoreutils-gui-2.0.52-8.fc9.i386
selinux-policy-3.3.1-87.fc9.noarch


Thx,
LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com