Re: Be careful with rules
On Mon, Jun 6, 2022 at 7:10 PM Lenny Bruzenak <lenny(a)magitekltd.com> wrote:
I've been told that it is not a potential security problem, and
not subject to change in the (current) kernel.
I'm that little birdy that Lenny was talking to off-list so I figured
I would add a quick comment here :)
As a reminder, elevated privilege is needed to both add/remove/modify
audit rules as well as the loaded SELinux policy (affecting the
validity of the relevant security labels). Also, as Lenny already
mentioned, if an invalid security label is used, the kernel will
notify the admin via the kernel log.
--
paul-moore.com