Re: audit in /selinux directory

On Fri, 2007-03-09 at 16:13 -0500, Stephen Smalley wrote: > On Fri, 2007-03-09 at 15:23 -0500, Steve Grubb wrote: > > On Friday 09 March 2007 14:31, Camilo Y. Campo wrote: > > > The cat command failed and audit is saying "success". A bit strange for > > > me. Could anybody clarify this point for me, please? > > > > It works correctly for me: > > > > fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0 > > open("/selinux/disable", O_RDONLY|O_LARGEFILE) = -1 EACCES (Permission denied) > > You got EACCES rather than EINVAL, so your test didn't reach the same > point in the code path. Try it as root (and with appropriate SELinux > role/domain if under -strict or -mls). I tried it, and the open succeeds, but the read fails with -EINVAL because the underlying pseudo file doesn't implement a read method at all for that node. So the audit is only capturing the open, which was successful.