audit 1.2.2 released
Linda Knippers
linda.knippers at hp.com
Tue May 16 15:53:41 UTC 2006
Steve Grubb wrote:
> On Tuesday 16 May 2006 10:53, Michael C Thompson wrote:
>
>>>[ resulting log activity:
>>>type=AVC msg=audit(1147657744.953:39): avc: denied { nlmsg_readpriv }
>>>for pid=2091 comm="auditctl"
>>>scontext=root:staff_r:staff_t:s0-s15:c0.c255
>>>tcontext=root:staff_r:staff_t:s0-s15:c0.c255 tclass=netlink_audit_socket
>>>type=SYSCALL msg=audit(1147657744.953:39): arch=40000003 syscall=102
>>>success=yes exit=16 a0=b a1=bfad2760 a2=805b0f8 a3=10 items=0 ppid=2067
>>>pid=2091 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
>>>tty=pts1 comm="auditctl" exe="/sbin/auditctl"
>>>subj=root:staff_r:staff_t:s0-s15:c0.c255
>>>type=SOCKADDR msg=audit(1147657744.953:39):
>>>saddr=100000000000000000000000 type=SOCKETCALL
>>>msg=audit(1147657744.953:39): nargs=6 a0=3 a1=bfad69fc a2=10 a3=0
>>>a4=bfad2790 a5=c
>>>]
>
>
> I missed this. This is the smoking gun...why did SE Linux reject the syscall?
> Next time, SE Linux was OK and allowed access. I wonder if this points to an
> avc caching problem since subsequent attempts is just fine.
His transcript was when running in permissive mode so won't you only get
the avc deny once?
-- ljk
>
> -Steve
>
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
More information about the Linux-audit
mailing list