Re: audit 1.2.2 released

[Linda Knippers <linda.knippers@hp.com>]

Steve Grubb wrote:
> On Tuesday 16 May 2006 10:53, Michael C Thompson wrote:
> 
>>>[ resulting log activity:
>>>type=AVC msg=audit(1147657744.953:39): avc:  denied  { nlmsg_readpriv }
>>>for  pid=2091 comm="auditctl"
>>>scontext=root:staff_r:staff_t:s0-s15:c0.c255
>>>tcontext=root:staff_r:staff_t:s0-s15:c0.c255 tclass=netlink_audit_socket
>>>type=SYSCALL msg=audit(1147657744.953:39): arch=40000003 syscall=102
>>>success=yes exit=16 a0=b a1=bfad2760 a2=805b0f8 a3=10 items=0 ppid=2067
>>>pid=2091 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
>>>tty=pts1 comm="auditctl" exe="/sbin/auditctl"
>>>subj=root:staff_r:staff_t:s0-s15:c0.c255
>>>type=SOCKADDR msg=audit(1147657744.953:39):
>>>saddr=100000000000000000000000 type=SOCKETCALL
>>>msg=audit(1147657744.953:39): nargs=6 a0=3 a1=bfad69fc a2=10 a3=0
>>>a4=bfad2790 a5=c
>>>]
> 
> 
> I missed this. This is the smoking gun...why did SE Linux reject the syscall? 
> Next time, SE Linux was OK and allowed access. I wonder if this points to an 
> avc caching problem since subsequent attempts is just fine.

His transcript was when running in permissive mode so won't you only get
the avc deny once?

-- ljk

> 
> -Steve
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit