Re: SELinux policy reload cannot be sent to audit system

Le 03/11/15 17:28, Steve Grubb a écrit : > On Tuesday, November 03, 2015 05:05:55 PM Laurent Bigonville wrote: >> Hi, >> >> With dbus 1.10.2 (on Debian), when I'm running "semodule -B", the system >> dbus daemon is complaining with the following message: >> >> nov 03 15:02:57 soldur dbus[1057]: Can't send to audit system: USER_AVC >> avc: received policyload notice (seqno=3) exe="/usr/bin/dbus-daemon" >> sauid=102 hostname=? addr=? terminal=? >> >> This is the system dbus daemon running as "messagebus": >> >> message+ 1057 0.0 0.0 127756 4524 ? Ssl 10:39 0:11 >> /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile >> --systemd-activation >> >> Looking at the capabilities: >> >> $ sudo getpcaps 1057 >> Capabilities for `1057': = cap_audit_write+ep >> >> All other user_avc seems to be properly logged in audit. >> >> An idea? > > I'd patch it to syslog errno and other information to locate the syscall > that's failing. Did socket fail? Did the send fail? Does it work in > permissive mode? I'm running in permissive mode. I'm seeing a netlink open to the audit: dbus-daem 1057 messagebus 7u netlink 0t0 15248 AUDIT Apparently audit_send() returns -1

I've been to reproduce this on F23 as well.

BTW if I'm trying to compile audit with gcc optimization disabled (-O0) I get: libtool: link: gcc -D_GNU_SOURCE -g -O0 -fstack-protector-strong -Wformat -Werror=format-security -Wl,-z -Wl,relro -Wl,--as-needed -o .libs/auvirt auvirt.o auvirt-list.o ausearch-time.o -L../../auparse /<<PKGBUILDDIR>>/debian/build/auparse/.libs/libauparse.so auvirt.o: In function `process_machine_id_event': /<<PKGBUILDDIR>>/debian/build/tools/auvirt/../../../../tools/auvirt/auvirt.c :484: undefined reference to `copy_str'