From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael C Thompson <thompsmc@us.ibm.com>
Subject: Re: audit 1.2.2 released
Date: Mon, 15 May 2006 15:14:13 -0500
Message-ID: <4468E115.40107@us.ibm.com>
References: <200605121726.32952.sgrubb@redhat.com>
	<4468DD20.8020600@us.ibm.com>
	<200605151604.51642.sgrubb@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <200605151604.51642.sgrubb@redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Steve Grubb <sgrubb@redhat.com>
Cc: Linux Audit <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

Steve Grubb wrote:
> On Monday 15 May 2006 15:57, Michael C Thompson wrote:
>> auditctl is still reporting the "error sending rule" problem. Here are
>> my auditctl and kernel versions:
>>
>> auditctl version 1.2.2
>> 2.6.16-1.2200.2.2_FC6.lspp.25
>>
>> # auditctl -l
>> Error sending rule list request (Operation not permitted)
> 
> This is not the error sending rule problem. This looks like a permission 
> problem. What selinux policy and role are you doing this from? Are there any  
> relevant AVCs in the audit logs from this time?
> 
> -Steve

This is a transcript from Permissive mode, with role being staff_r. I do 
not see the "Error sending rule list request (Operation not permitted)" 
when SELinux is disabled (selinux=0) or when as auditadm_r at SystemHigh.

# auditctl -l
Error sending rule list request (Operation not permitted)
[ resulting log activity:
type=AVC msg=audit(1147657744.953:39): avc:  denied  { nlmsg_readpriv } 
for  pid=2091 comm="auditctl" 
scontext=root:staff_r:staff_t:s0-s15:c0.c255 
tcontext=root:staff_r:staff_t:s0-s15:c0.c255 tclass=netlink_audit_socket
type=SYSCALL msg=audit(1147657744.953:39): arch=40000003 syscall=102 
success=yes exit=16 a0=b a1=bfad2760 a2=805b0f8 a3=10 items=0 ppid=2067 
pid=2091 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 
tty=pts1 comm="auditctl" exe="/sbin/auditctl" 
subj=root:staff_r:staff_t:s0-s15:c0.c255
type=SOCKADDR msg=audit(1147657744.953:39): saddr=100000000000000000000000
type=SOCKETCALL msg=audit(1147657744.953:39): nargs=6 a0=3 a1=bfad69fc 
a2=10 a3=0 a4=bfad2790 a5=c
]

# auditctl -l
No rules
[ no log activity ]

Why does auditctl report a denial for the 1st attempt, and not for later 
attempts?

Thanks,
Mike