From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael C Thompson <thompsmc@us.ibm.com>
Subject: Re: auditctl se_sen & se_clr
Date: Fri, 19 May 2006 12:44:14 -0500
Message-ID: <446E03EE.5090707@us.ibm.com>
References: <446DDF21.4080808@us.ibm.com>	<1148051869.25168.144.camel@moss-spartans.epoch.ncsc.mil>	<446DE48C.3010509@us.ibm.com>
	<1148056260.3469.222.camel@code.and.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <1148056260.3469.222.camel@code.and.org>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: James Antill <jantill@redhat.com>
Cc: Linux Audit <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

James Antill wrote:
> On Fri, 2006-05-19 at 10:30 -0500, Michael C Thompson wrote:
> 
>> Thanks, that's what I thought as well. Here is my result of testing this:
>>
>> root linux user, id:
>> uid=0(root) gid=0(root) 
>> groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) 
>> context=root:staff_r:staff_t:SystemLow-SystemHigh
>>
>> mcthomps linux user, id:
>> uid=500(mcthomps) gid=500(mcthomps) groups=500(mcthomps) 
>> context=user_u:user_r:user_t:SystemLow
>>
>> When I have the following audit rule is
>>    auditctl -a entry,always -S chmod -F se_clr=s0
>> the chmod actions taken by mcthomps get logged, but not those done by 
>> root (this is as expected).
> 
> 
>  This means that a "range" of s0 is being interpreted as:
> 
> se_sen=''
> se_clr='s0'
> 
> ...which isn't what I'd expect, but given that...

I'm sorry, I do not follow what you mean here.

>> When the audit rule is
>>    auditctl -a entry,always -S chmod -F se_clr=s15:c0.c255
>> the chmod actions taken by root get logged, but not by mcthomps (also 
>> expected).
>>
>> However, for se_sen, this does not seem to be the case. The rule:
>>    auditctl -a entry,always -S chmod -F se_se=s0
>> should cause chmod actions taken by both mcthomps and root to be logged, 
>> right? However, I'm only seeing the result of actions taken by mcthomps.
> 
>  This follows the same methodology.

again, I'm confused as to what you mean.

Thanks,
Mike