Re: sealert and FC17

[Daniel J Walsh <dwalsh@xxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/03/2012 11:35 AM, m.roth@xxxxxxxxx wrote:
> Thomas Cameron wrote:
>> On 08/03/2012 09:06 AM, m.roth@xxxxxxxxx wrote:
>>> Dan,
>>> 
>>> I read your post at <http://danwalsh.livejournal.com/26053.html>, but 
>>> what I still don't understand is this: on a user's system (actually,
>>> my manager's). What I need, and not just for his system, is a way to
>>> do what setroubleshoot *used* to do: give me a sealert in a logfile so
>>> I can run it from a command line.
>> 
>> Have you installed setroubleshoot and setroubleshoot-server?
>> 
>> Once you do, you can use e.g. sealert to read the alerts from the command
>> line.
> 
> I must be missing something. Yes, they're both installed. I tried sealert 
> -a /var/log/audit/audit.log, and got nothing - in there, I see a lot of 
> SERVICE START and SERVICE STOP. I tried the same on /var/log/messages, 
> where I see avc's; for example, <timestamp> <name>  kernel: [96575.845662]
> type=1400 audit(1344007740.130:4055): avc:  denied  { open } for  pid=5804 
> comm="awk" name="ld.so.cache" dev="dm-0" ino=61036 
> scontext=system_u:system_r:ksmtuned_t:s0 
> tcontext=system_u:object_r:file_t:s0 tclass=file
> 
> but get nothing. What am I missing?
> 
> mark
> 
> -- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx 
> https://admin.fedoraproject.org/mailman/listinfo/selinux
> 
Looks like sealert does not recognize this as an AVC.  Not sure why.  I will
look into it.  Anyways file_t means your machine is seriosly mislabeled.
file_t means the object has no label on it, in dhis case ld.so.cache, which
will cause everything to blow up.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAlAdC2gACgkQrlYvE4MpobOjngCeKyiL1q27BqKT/wht5xa+K9AF
NKgAn1R7tLzTApEyaXa7dxXTXTGK0mhr
=BKsw
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux