Not to sound impatient, but is there any word from RH devel about
updates to fix this problem?
I know you said before that Fedora was supposed to provide an update for
selinux, and they either
changed their minds or haven't gotten around to it yet (sorry I don't
have the thread to qyote but
I'm sure you recall mentioning "something" along those lines).
As a test I decided to run RKH 1.2.8 (I have 1.2.9 also but .8 is still
my default) and I ran audit log
along with it and I don't know if this helps, but thought I'd post it
just in case. There is nothing
unusual in the logs except when running the hashes I got this
type=AVC msg=audit(1164919542.914:2852): avc: denied { read write }
for pid=28351 comm="prelink" name="1" dev=devpts ino=3
scontext=user_u:system_r:prelink_t:s0
tcontext=user_u:object_r:devpts_t:s0 tclass=chr_file
type=AVC msg=audit(1164919542.914:2852): avc: denied { read write }
for pid=28351 comm="prelink" name="1" dev=devpts ino=3
scontext=user_u:system_r:prelink_t:s0
tcontext=user_u:object_r:devpts_t:s0 tclass=chr_file
type=AVC msg=audit(1164919542.914:2852): avc: denied { write } for
pid=28351 comm="prelink" name="prelink.tst" dev=hda6 ino=243470
scontext=user_u:system_r:prelink_t:s0 tcontext=user_u:object_r:var_t:s0
tclass=file
type=AVC msg=audit(1164919542.914:2852): avc: denied { read write }
for pid=28351 comm="prelink" name="1" dev=devpts ino=3
scontext=user_u:system_r:prelink_t:s0
tcontext=user_u:object_r:devpts_t:s0 tclass=chr_file
type=SYSCALL msg=audit(1164919542.914:2852): arch=40000003 syscall=11
success=yes exit=0 a0=92db690 a1=92dbbc8 a2=925d220 a3=92de610 items=0
ppid=28350 pid=28351 auid=501 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="prelink" exe="/usr/sbin/prelink"
subj=user_u:system_r:prelink_t:s0 key=(null)
Perhaps you are already aware of this since you say it is an selinux +
prelink problem. Just thought it wouldn't
hurt to post it.
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Rkhunter-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/rkhunter-users
