From mboxrd@z Thu Jan 1 00:00:00 1970 From: Linda Knippers Subject: Re: audit 1.2.2 released Date: Tue, 16 May 2006 11:53:41 -0400 Message-ID: <4469F585.6030108@hp.com> References: <200605121726.32952.sgrubb@redhat.com> <4468E115.40107@us.ibm.com> <4469E753.3070206@us.ibm.com> <200605161134.29407.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200605161134.29407.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: Linux Audit List-Id: linux-audit@redhat.com Steve Grubb wrote: > On Tuesday 16 May 2006 10:53, Michael C Thompson wrote: > >>>[ resulting log activity: >>>type=AVC msg=audit(1147657744.953:39): avc: denied { nlmsg_readpriv } >>>for pid=2091 comm="auditctl" >>>scontext=root:staff_r:staff_t:s0-s15:c0.c255 >>>tcontext=root:staff_r:staff_t:s0-s15:c0.c255 tclass=netlink_audit_socket >>>type=SYSCALL msg=audit(1147657744.953:39): arch=40000003 syscall=102 >>>success=yes exit=16 a0=b a1=bfad2760 a2=805b0f8 a3=10 items=0 ppid=2067 >>>pid=2091 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 >>>tty=pts1 comm="auditctl" exe="/sbin/auditctl" >>>subj=root:staff_r:staff_t:s0-s15:c0.c255 >>>type=SOCKADDR msg=audit(1147657744.953:39): >>>saddr=100000000000000000000000 type=SOCKETCALL >>>msg=audit(1147657744.953:39): nargs=6 a0=3 a1=bfad69fc a2=10 a3=0 >>>a4=bfad2790 a5=c >>>] > > > I missed this. This is the smoking gun...why did SE Linux reject the syscall? > Next time, SE Linux was OK and allowed access. I wonder if this points to an > avc caching problem since subsequent attempts is just fine. His transcript was when running in permissive mode so won't you only get the avc deny once? -- ljk > > -Steve > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit