audisp plugin policy question(s)
Steve Grubb
sgrubb at redhat.com
Wed Oct 22 16:53:53 UTC 2008
On Wednesday 22 October 2008 12:46:24 LC Bruzenak wrote:
> In the audisp plugin sources (and audit.spec), the zos-remote plugin has
> a policy section, the others do not. Will those pieces be added
> similarly? Should prelude/prelude-plugin/remote-plugin policy go here or
> in the system policy rpm?
No. I removed SE Linux policy in this commit last week:
https://fedorahosted.org/audit/changeset/134
> Right now my prelude-manager runs ranged SystemLow-SystemHigh.
> Should this be only SystemHigh?
I would put the prelude manager and correlator at the same level as the audit
daemon since they get parts of the audit logs in events. So, if auditd is
ranged, prelude should be.
> There are some spool files not set accordingly which cause AVCs.
> I guess these need file contexts?
Yep. Those spools are likely storage for transmissions while prelude-manager
is down.
> Then there is a prelude-manager<->prelude-lml question, but I won't get
> into that in case I hear "take it up with the prelude guys" from the
> above.
I would take it up with them iff you have a reproducable problem when not in
MLS. If its only shows up when on MLS, you likely have a policy problem.
-Steve
More information about the Linux-audit
mailing list