P.S. - RE: [redhat-list] updates pending question
Constance Morris
cmorris at daltonstate.edu
Fri May 10 21:05:25 UTC 2013
-----Original Message-----
From: redhat-list-bounces at redhat.com [mailto:redhat-list-bounces at redhat.com] On Behalf Of m.roth at 5-cent.us
Sent: Friday, May 10, 2013 4:19 PM
To: General Red Hat Linux discussion list
Subject: RE: P.S. - RE: [redhat-list] updates pending question
Constance Morris wrote:
> [mailto:redhat-list-bounces at redhat.com] On Behalf Of m.roth at 5-cent.us
<snip>
>> You want a good laugh.....I did copy yours. Oops.
>> I do not see any sealert info in the messages log. Do I need to run
>> or rather start sealer?
>
> Nope. If auditd is running, that's all you need. If you see no
> sealerts in /var/log/messages, or AVCs in /var/log/audit/audit.log, be
> happy. The messages are for specific AVCs on *your* system, they're not generic.
<snip>
> I do get AVC messages in the audit.log file :
> type=AVC msg=audit(1368211292.794:1593): avc: denied { search } for
> pid=13587 comm="procmail" name="www" dev=dm-0 ino=3440923
> scontext=system_u:system_r:procmail_t:s0
> tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
Ok, and that really did happen, since you're enforcing, not permissive.
There should be a message in /var/log/messages with the kind of wording I posted, and it'll give you the command line for sealert.
Mark
--------------------
Mark,
This is all I see in the /var/log/messages area for setroubleshoot......
May 10 13:42:22 www yum: Installed: setroubleshoot-2.0.5-5.el5_8.1.noarch
May 10 13:57:43 www setroubleshoot: [rpc.ERROR] attempt to open server connection failed: No such file or directory
I really appreciate yours and Alfred's help and continued patience with me. I don't understand why this is so hard for me to fix and I'm sorry if I am being a pest.
Constance
More information about the redhat-list
mailing list