Linux-audit Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Daniel J Walsh <dwalsh@redhat.com>
To: Stephen Smalley <sds@tycho.nsa.gov>
Cc: linux-audit@redhat.com, "Göran Uddeborg" <goeran@uddeborg.se>,
	selinux@lists.fedoraproject.org
Subject: Re: How do I figure out on what file dac_override is attempted?
Date: Wed, 20 Jan 2010 10:12:56 -0500	[thread overview]
Message-ID: <4B571D78.3060000@redhat.com> (raw)
In-Reply-To: <1263995482.24133.26.camel@moss-pluto.epoch.ncsc.mil>

On 01/20/2010 08:51 AM, Stephen Smalley wrote:
> On Wed, 2010-01-20 at 13:47 +0100, Göran Uddeborg wrote:
>> Stephen Smalley:
>>> To get object information, you need to enable
>>> syscall auditing, and add a trivial syscall filter to turn on pathname
>>> collection by the audit subsystem.
>>
>> Thanks for that tip (all of you who gave it)!  I now know it is
>> /dev/fb that plymouthd can't access.  The audit record also told me it
>> was owned by a regular user and mode rw-------.  So now it makes
>> sense.  A root process would need dac_override to open that file.
> 
> That tip really ought to get captured in the Fedora SELinux FAQ or
> Guide.  Dan?
> 

You mean turning on full auditing if you have a suspicious DAC_OVERRIDE?

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

  parent reply	other threads:[~2010-01-20 15:12 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <19284.52512.295295.185383@gargle.gargle.HOWL>
2010-01-19 14:52 ` How do I figure out on what file dac_override is attempted? Stephen Smalley
     [not found] ` <1263912766.12068.12.camel@moss-pluto.epoch.ncsc.mil>
2010-01-19 15:06   ` Daniel J Walsh
     [not found]   ` <4B55CA8B.3030706@redhat.com>
2010-01-19 15:23     ` Stephen Smalley
     [not found]   ` <19286.64383.173222.447312@gargle.gargle.HOWL>
2010-01-20 13:51     ` Stephen Smalley
     [not found]     ` <1263995482.24133.26.camel@moss-pluto.epoch.ncsc.mil>
2010-01-20 15:12       ` Daniel J Walsh [this message]
2010-01-20 15:22         ` Stephen Smalley
     [not found]         ` <1264000927.24133.93.camel@moss-pluto.epoch.ncsc.mil>
     [not found]           ` <4B572C29.8050600@manicmethod.com>
2010-01-20 19:23             ` Daniel J Walsh
     [not found]             ` <4B57582D.7070904@redhat.com>
2010-01-20 19:50               ` Stephen Smalley
     [not found]               ` <1264017052.24133.161.camel@moss-pluto.epoch.ncsc.mil>
2010-01-20 20:13                 ` Steve Grubb
2010-01-20 20:49                 ` Daniel J Walsh
     [not found]                 ` <4B576C58.3090801@redhat.com>
2010-01-20 20:57                   ` Stephen Smalley

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4B571D78.3060000@redhat.com \
    --to=dwalsh@redhat.com \
    --cc=goeran@uddeborg.se \
    --cc=linux-audit@redhat.com \
    --cc=sds@tycho.nsa.gov \
    --cc=selinux@lists.fedoraproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox