Following up on some instructions I found in the list archives (posted by Stephen Smalley), I set up the following policy (local.te) for a stock RHEL AS 4 build (using the targeted policy source)
# Allow all user domains to create and modify these files.
allow userdomain audited_file_t:dir create_dir_perms;
allow userdomain audited_file_t:{ file lnk_file } create_file_perms;
# Audit all accesses by user domains to these files.
auditallow userdomain audited_file_t:{ dir file lnk_file } *
I also set my grub.conf to set audit=1 and also set 'auditctl -e 1'
I created a directory off of root called /testdir and assigned it the following context: user_u:object_r:audited_file_t
I was hoping that all file activity in this directory would be logged but this does not seem to be happening. Is there something I am missing?
Thanks!
Eric Howard
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
