[prev in list] [next in list] [prev in thread] [next in thread] 

List:       selinux
Subject:    Re: Permissive mode for xace is broken.
From:       Eamon Walsh <ewalsh () tycho ! nsa ! gov>
Date:       2008-02-29 1:58:42
Message-ID: 47C766D2.3010905 () tycho ! nsa ! gov
[Download RAW message or body]

Steve Grubb wrote:
> On Thursday 28 February 2008 13:51:05 Stephen Smalley wrote:
>   
>> On Thu, 2008-02-28 at 13:48 -0500, Eamon Walsh wrote:
>>     
>>> Stephen Smalley wrote:
>>>       
>>>> On Mon, 2008-02-25 at 20:12 -0500, Eamon Walsh wrote:
>>>>         
>>>>> Eamon Walsh wrote:
>>>>>           
>>>>>> The X object manager logs all avc's and status messages (including
>>>>>> the AVC netlink stuff) through the audit system using libaudit calls
>>>>>> (audit_log_user_avc_message, etc.)
>>>>>>             
>
> Please tell me they have different record types. Also do you have any samples 
> that we can look over to make sure they conform?
>   

The  libselinux logging callback has support for four message types: 
"avc", "info", "warn", and "error".  What are the libaudit codes 
associated with these?  I see USER_AVC and SELINUX_USER_ERR.  The reload 
message is not really an "error."

Samples attached.  The avc messages generated by the X server have 
X-specific fields in them:

request (X protocol request name)
comm (program name)
client (X client number)
xdevice (name of X device)
resid (X resource ID)
restype (X resource type)
event (X event type)
property (X property name)
selection (X selection name)
extension (X extension name)

If you want these field names changed, for example prefixed with "x", 
please let me know.


>
>   
>>>> Can you verify that the X server was able to create the audit socket
>>>> successfully?
>>>>         
>>> Yes, because when I actually install the audit package, things started
>>> appearing in /var/log/audit/audit.log.  I did not have the audit package
>>> installed.  Why isn't it redirecting to /var/log/messages in this case?
>>>       
>
> It should be if you have audit enabled. Perhaps you didn't boot with audit=1?
>   

No, I didn't have this flag set.

-- 
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
[prev in list] [next in list] [prev in thread] [next in thread]