Re: audit 1.2.2 released

On Tuesday 16 May 2006 10:53, Michael C Thompson wrote: >>[ resulting log activity: >>type=AVC msg=audit(1147657744.953:39): avc: denied { nlmsg_readpriv } >>for pid=2091 comm="auditctl" >>scontext=root:staff_r:staff_t:s0-s15:c0.c255 >>tcontext=root:staff_r:staff_t:s0-s15:c0.c255 tclass=netlink_audit_socket >>type=SYSCALL msg=audit(1147657744.953:39): arch=40000003 syscall=102 >>success=yes exit=16 a0=b a1=bfad2760 a2=805b0f8 a3=10 items=0 ppid=2067 >>pid=2091 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 >>tty=pts1 comm="auditctl" exe="/sbin/auditctl" >>subj=root:staff_r:staff_t:s0-s15:c0.c255 >>type=SOCKADDR msg=audit(1147657744.953:39): >>saddr=100000000000000000000000 type=SOCKETCALL >>msg=audit(1147657744.953:39): nargs=6 a0=3 a1=bfad69fc a2=10 a3=0 >>a4=bfad2790 a5=c >>] I missed this. This is the smoking gun...why did SE Linux reject the syscall? Next time, SE Linux was OK and allowed access. I wonder if this points to an avc caching problem since subsequent attempts is just fine.

-Steve -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit