Re: audit collector startup help

On Tue, 2008-09-09 at 18:07 -0400, DJ Delorie wrote: Actually I believe one of the packages must installed my policy as enforcing. Thanks(!) to an excellent setroubleshoot pop-up I believe that was my problem: Source Context: unconfined_u:system_r:auditd_t:s0 Target Context: system_u:object_r:anon_inodefs_t:s0 Target Objects: anon_inode [ file ] Source: auditdSource Path: /sbin/auditd Port: <Unknown> Host: fryspc Source RPM Packages: audit-1.7.5-1.fc9 Target RPM Packages: Policy RPM: selinux-policy-3.3.1-87.fc9 Selinux Enabled: True Policy Type: targeted MLS Enabled: True Enforcing Mode: Enforcing Plugin Name: catchall_file Host Name: fryspc Platform: Linux fryspc 2.6.26.3-29.fc9.i686 #1 SMP Wed Sep 3 03:42:27 EDT 2008 i686 athlon Alert Count: 1 First Seen: Thu 11 Sep 2008 10:08:57 AM CDT Last Seen: Thu 11 Sep 2008 10:08:57 AM CDT Local ID: 8b4ff486-ae1c-4448-bf38-9b56658ebc01 Line Numbers: Raw Audit Messages : host=fryspc type=AVC msg=audit(1221145737.208:55): avc: denied { write } for pid=3280 comm="auditd" path="anon_inode:[eventfd]" dev=anon_inodefs ino=18 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=system_u:object_r:anon_inodefs_t:s0 tclass=file host=fryspc type=SYSCALL msg=audit(1221145737.208:55): arch=40000003 syscall=4 success=no exit=-13 a0=8 a1=bfb98880 a2=8 a3=b7f6aab8 items=0 ppid=1 pid=3280 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="auditd" exe="/sbin/auditd" subj=unconfined_u:system_r:auditd_t:s0 key=(null) ### note: I do not have an MLS policy on this machine (although the setroubleshoot summary says I do) - and I didn't change any policy defaults. [lenny@fryspc ~]$ rpm -qa | grep policy checkpolicy-2.0.16-3.fc9.i386 policycoreutils-2.0.52-8.fc9.i386 selinux-policy-targeted-3.3.1-87.fc9.noarch selinux-policy-devel-3.3.1-87.fc9.noarch policycoreutils-gui-2.0.52-8.fc9.i386 selinux-policy-3.3.1-87.fc9.noarch Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com