Re: audit 1.2.2 released
On Tuesday 16 May 2006 10:53, Michael C Thompson wrote:
> [ resulting log activity:
> type=AVC msg=audit(1147657744.953:39): avc: denied { nlmsg_readpriv }
> for pid=2091 comm="auditctl"
> scontext=root:staff_r:staff_t:s0-s15:c0.c255
> tcontext=root:staff_r:staff_t:s0-s15:c0.c255 tclass=netlink_audit_socket
> type=SYSCALL msg=audit(1147657744.953:39): arch=40000003 syscall=102
> success=yes exit=16 a0=b a1=bfad2760 a2=805b0f8 a3=10 items=0 ppid=2067
> pid=2091 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
> tty=pts1 comm="auditctl" exe="/sbin/auditctl"
> subj=root:staff_r:staff_t:s0-s15:c0.c255
> type=SOCKADDR msg=audit(1147657744.953:39):
> saddr=100000000000000000000000 type=SOCKETCALL
> msg=audit(1147657744.953:39): nargs=6 a0=3 a1=bfad69fc a2=10 a3=0
> a4=bfad2790 a5=c
> ]
I missed this. This is the smoking gun...why did SE Linux reject the syscall?
Next time, SE Linux was OK and allowed access. I wonder if this points to an
avc caching problem since subsequent attempts is just fine.
-Steve