Hi,
I'm try to develop an Auditd plugin.
This plugin needs to read information about some processes by reading /proc filesystem.
But the SELinux policy applied to Auditd (and his plugins) prevent the access.
I'm using AlmaLinux release 8.8 (Sapphire Caracal) distribution
Auditd version: audit-3.0.7-4.el8.x86_64
SELinux Auditd plugin context: system_u:system_r:auditd_t:s0
If I run the plugin directly from bash, it can read all the informations it need (but
obviously it cannot receive Auditd logs :-) )
There is a solution?
Thanks in advance.