Re: audisp plugin policy question(s)

[Steve Grubb <sgrubb@redhat.com>]

On Wednesday 22 October 2008 12:46:24 LC Bruzenak wrote:
> In the audisp plugin sources (and audit.spec), the zos-remote plugin has
> a policy section, the others do not. Will those pieces be added
> similarly? Should prelude/prelude-plugin/remote-plugin policy go here or
> in the system policy rpm?

No. I removed SE Linux policy in this commit last week:

https://fedorahosted.org/audit/changeset/134


> Right now my prelude-manager runs ranged SystemLow-SystemHigh.
> Should this be only SystemHigh?

I would put the prelude manager and correlator at the same level as the audit 
daemon since they get parts of the audit logs in events. So, if auditd is 
ranged, prelude should be.


> There are some spool files not set accordingly which cause AVCs.
> I guess these need file contexts?

Yep. Those spools are likely storage for transmissions while prelude-manager 
is down.


> Then there is a prelude-manager<->prelude-lml question, but I won't get
> into that in case I hear "take it up with the prelude guys" from the
> above.

I would take it up with them iff you have a reproducable problem when not in 
MLS. If its only shows up when on MLS, you likely have a policy problem.

-Steve