From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Gruhn Subject: Re: auditctl -1 User ID Date: Wed, 18 Feb 2009 16:24:29 -0500 Message-ID: <499C7C8D.8030504@groupw.com> References: <499C425E.1050804@groupw.com> <200902181230.07368.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n1ILOdWP028742 for ; Wed, 18 Feb 2009 16:24:39 -0500 Received: from smtp.group-w-inc.com (group-w-inc.com [70.164.45.3]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n1ILOUeV001096 for ; Wed, 18 Feb 2009 16:24:30 -0500 Received: from smtp.group-w-inc.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with ESMTP id ADFE0DA00AC for ; Wed, 18 Feb 2009 16:24:29 -0500 (EST) Received: from [10.1.1.218] (dgruhn-f9.group-w-inc.com [10.1.1.218]) by smtp.group-w-inc.com (Postfix) with ESMTP id 764ABDA0094 for ; Wed, 18 Feb 2009 16:24:29 -0500 (EST) In-Reply-To: <200902181230.07368.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Thanks Steve. Steve Grubb wrote: > On Wednesday 18 February 2009 12:16:14 pm Dan Gruhn wrote: > >> I'm getting an auditctl startup SELinux violation that is showing up >> with a user ID of -1 (4294967295 in my case). >> > > -1 means that the command was run by something that was not initiated by a > login. IOW, probably initscripts. > > > >> I can fix the violation, but before I do I thought I saw something a while >> back about setting a parameter or defining a variable on power-up so that >> one didn't get the -1 for something that came up in the wrong order. >> > > There is nothing that fixes that. This is just a statement of fact. The error > originated from a non-login path. What you might be remembering is that you > should put a audit=1 in the boot params of the kernel. This is so that you > don't have any unauditable processes. > > -Steve > -- Dan Gruhn Group W Inc. 8315 Lee Hwy, Suite 303 Fairfax, VA, 22031 PH: (703) 752-5831 FX: (703) 752-5851