From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: audisp plugin policy question(s) Date: Wed, 22 Oct 2008 12:53:53 -0400 Message-ID: <200810221253.54018.sgrubb@redhat.com> References: <1224693984.14755.115.camel@homeserver> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1224693984.14755.115.camel@homeserver> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Wednesday 22 October 2008 12:46:24 LC Bruzenak wrote: > In the audisp plugin sources (and audit.spec), the zos-remote plugin has > a policy section, the others do not. Will those pieces be added > similarly? Should prelude/prelude-plugin/remote-plugin policy go here or > in the system policy rpm? No. I removed SE Linux policy in this commit last week: https://fedorahosted.org/audit/changeset/134 > Right now my prelude-manager runs ranged SystemLow-SystemHigh. > Should this be only SystemHigh? I would put the prelude manager and correlator at the same level as the audit daemon since they get parts of the audit logs in events. So, if auditd is ranged, prelude should be. > There are some spool files not set accordingly which cause AVCs. > I guess these need file contexts? Yep. Those spools are likely storage for transmissions while prelude-manager is down. > Then there is a prelude-manager<->prelude-lml question, but I won't get > into that in case I hear "take it up with the prelude guys" from the > above. I would take it up with them iff you have a reproducable problem when not in MLS. If its only shows up when on MLS, you likely have a policy problem. -Steve