With the following contexts:
bash-3.1# id
uid=0(root) gid=0(root)
groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
context=staff_u:auditadm_r:auditadm_t:s15:c0.c1023
bash-3.1# ls -Z /var/log/audit/audit.log
-rw-r----- root root system_u:object_r:auditd_log_t:s15:c0.c1023
/var/log/audit/audit.log
Doing a simple less /var/log/audit/audit.log generates the following AVC
records. The operation succeeds, but this seems like an excessive amount
of records that are being generated. Is there a reason why auditadm_t is
disallowed dac_override?
type=AVC msg=audit(1161117931.187:182): avc: denied { dac_override }
for pid=1998 comm="less" capability=1
scontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023
tcontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023 tclass=capability
type=AVC msg=audit(1161117931.187:182): avc: denied { dac_read_search
} for pid=1998 comm="less" capability=2
scontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023
tcontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023 tclass=capability
type=SYSCALL msg=audit(1161117931.187:182): arch=14 syscall=33
success=no exit=-13 a0=fefcdfec a1=4 a2=0 a3=fefefeff items=0 ppid=1846
pid=1998 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=pts2 comm="less" exe="/usr/bin/less"
subj=staff_u:auditadm_r:auditadm_t:s15:c0.c1023 key=(null)
type=AVC msg=audit(1161117931.187:183): avc: denied { dac_override }
for pid=1998 comm="less" capability=1
scontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023
tcontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023 tclass=capability
type=AVC msg=audit(1161117931.187:183): avc: denied { dac_read_search
} for pid=1998 comm="less" capability=2
scontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023
tcontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023 tclass=capability
type=SYSCALL msg=audit(1161117931.187:183): arch=14 syscall=5 success=no
exit=-13 a0=100400d8 a1=10000 a2=0 a3=73 items=0 ppid=1846 pid=1998
auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=pts2 comm="less" exe="/usr/bin/less"
subj=staff_u:auditadm_r:auditadm_t:s15:c0.c1023 key=(null)
type=AVC msg=audit(1161117931.187:184): avc: denied { dac_override }
for pid=1998 comm="less" capability=1
scontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023
tcontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023 tclass=capability
type=AVC msg=audit(1161117931.187:184): avc: denied { dac_read_search
} for pid=1998 comm="less" capability=2
scontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023
tcontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023 tclass=capability
type=SYSCALL msg=audit(1161117931.187:184): arch=14 syscall=5 success=no
exit=-13 a0=10042200 a1=10000 a2=1b6 a3=1b6 items=0 ppid=1846 pid=1998
auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=pts2 comm="less" exe="/usr/bin/less"
subj=staff_u:auditadm_r:auditadm_t:s15:c0.c1023 key=(null)
type=AVC msg=audit(1161117931.195:185): avc: denied { dac_override }
for pid=1999 comm="sh" capability=1
scontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023
tcontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023 tclass=capability
type=AVC msg=audit(1161117931.195:185): avc: denied { dac_read_search
} for pid=1999 comm="sh" capability=2
scontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023
tcontext=staff_u:auditadm_r:auditadm_t:s15:c0.c1023 tclass=capability
type=SYSCALL msg=audit(1161117931.195:185): arch=14 syscall=195
success=no exit=-13 a0=100b0b10 a1=fe36f660 a2=fe36f660
a3=fffffffffefefeff items=0 ppid=1998 pid=1999 auid=500 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 comm="sh"
exe="/bin/bash" subj=staff_u:auditadm_r:auditadm_t:s15:c0.c1023 key=(null)
--
redhat-lspp mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/redhat-lspp
