From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: SELinux policy reload cannot be sent to audit system
Date: Tue, 03 Nov 2015 11:28:49 -0500 [thread overview]
Message-ID: <1758315.3fUBHW9xxQ@x2> (raw)
In-Reply-To: <5638DB63.7010204@debian.org>
On Tuesday, November 03, 2015 05:05:55 PM Laurent Bigonville wrote:
> Hi,
>
> With dbus 1.10.2 (on Debian), when I'm running "semodule -B", the system
> dbus daemon is complaining with the following message:
>
> nov 03 15:02:57 soldur dbus[1057]: Can't send to audit system: USER_AVC
> avc: received policyload notice (seqno=3) exe="/usr/bin/dbus-daemon"
> sauid=102 hostname=? addr=? terminal=?
>
> This is the system dbus daemon running as "messagebus":
>
> message+ 1057 0.0 0.0 127756 4524 ? Ssl 10:39 0:11
> /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile
> --systemd-activation
>
> Looking at the capabilities:
>
> $ sudo getpcaps 1057
> Capabilities for `1057': = cap_audit_write+ep
>
> All other user_avc seems to be properly logged in audit.
>
> An idea?
I'd patch it to syslog errno and other information to locate the syscall
that's failing. Did socket fail? Did the send fail? Does it work in permissive
mode?
-Steve
next prev parent reply other threads:[~2015-11-03 16:28 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-11-03 16:05 SELinux policy reload cannot be sent to audit system Laurent Bigonville
2015-11-03 16:28 ` Steve Grubb [this message]
2015-11-03 16:38 ` Paul Moore
2015-11-03 17:12 ` Laurent Bigonville
2015-11-03 19:33 ` Steve Grubb
2015-11-03 20:08 ` Richard Guy Briggs
2015-11-03 20:48 ` Laurent Bigonville
2015-11-05 3:23 ` Steve Grubb
2015-11-05 8:32 ` Laurent Bigonville
2015-11-05 9:26 ` Laurent Bigonville
2015-11-05 13:20 ` Steve Grubb
2015-11-05 23:03 ` Steve Grubb
2015-11-05 23:19 ` Laurent Bigonville
2015-11-06 1:25 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1758315.3fUBHW9xxQ@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).