Re: audisp plugin policy question(s)
On Wednesday 22 October 2008 12:46:24 LC Bruzenak wrote:
In the audisp plugin sources (and audit.spec), the zos-remote plugin
has
a policy section, the others do not. Will those pieces be added
similarly? Should prelude/prelude-plugin/remote-plugin policy go here or
in the system policy rpm?
No. I removed SE Linux policy in this commit last week:
https://fedorahosted.org/audit/changeset/134
Right now my prelude-manager runs ranged SystemLow-SystemHigh.
Should this be only SystemHigh?
I would put the prelude manager and correlator at the same level as the audit
daemon since they get parts of the audit logs in events. So, if auditd is
ranged, prelude should be.
There are some spool files not set accordingly which cause AVCs.
I guess these need file contexts?
Yep. Those spools are likely storage for transmissions while prelude-manager
is down.
Then there is a prelude-manager<->prelude-lml question, but I
won't get
into that in case I hear "take it up with the prelude guys" from the
above.
I would take it up with them iff you have a reproducable problem when not in
MLS. If its only shows up when on MLS, you likely have a policy problem.
-Steve