From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael C Thompson Subject: Re: audit 1.2.2 released Date: Wed, 24 May 2006 14:44:50 -0500 Message-ID: <4474B7B2.6030601@us.ibm.com> References: <200605121726.32952.sgrubb@redhat.com> <4469F585.6030108@hp.com> <200605161323.32162.sgrubb@redhat.com> <200605221331.54945.sgrubb@redhat.com> <4473374C.8030902@us.ibm.com> <44738AA0.50006@us.ibm.com> <44739521.7080602@hp.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <44739521.7080602@hp.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linda Knippers Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Linda Knippers wrote: > I'm running the .27 kernel and the 1.2.2 tools on an x86_64 > (Xeon/EM64T) SMP box with the targeted policy in enforcing mode. > I tried to reproduce the problem discussed yesterday (the very fist > rule doesn't take and the rest do) but it seems to work fine on my > system. I've been running mostly on an i686 (Intel) with the .27 kernel and 1.2.2 tools with the MLS policy. I've tested this on an x86_64 (AMD opteron) and see this problem too. However, this problem does NOT exist when using targeted policy, so it is most likely an MLS SELinux issue. My MLS policy is 2.2.42 > Can you describe more about your configuration and provide exact steps > to reproduce the problem? 1) Reboot your system (so you've a clean slate) 2) Login (tty or pty, doesn't matter, I've done both) 3) auditctl -l Error sending rule list request (Operation not permitted) 4) auditctl -l No rules (or whatever you expect to see) > If you and Loulwa are seeing it but George > (at least not on ppc64) and I aren't, there's got to be something > different about what we're doing or what we're doing it on. Loulwa sees this problem (I used her x86_64 machine above) and I have just seen this problem on George's machine (he was originally not using the MLS policy). Therefore, this evidence leads me to believe its an issue in the MLS policy, although I do not what the problem is. Thanks, Mike