Steve Grubb wrote:
On Thursday 28 February 2008 13:51:05 Stephen Smalley wrote:
On Thu, 2008-02-28 at 13:48 -0500, Eamon Walsh wrote:
Stephen Smalley wrote:
On Mon, 2008-02-25 at 20:12 -0500, Eamon Walsh wrote:
Eamon Walsh wrote:
The X object manager logs all avc's and status messages (including
the AVC netlink stuff) through the audit system using libaudit calls
(audit_log_user_avc_message, etc.)
Please tell me they have different record types. Also do you have any samples
that we can look over to make sure they conform?
The libselinux logging callback has support for four message types:
"avc", "info", "warn", and "error". What are the libaudit codes
associated with these? I see USER_AVC and SELINUX_USER_ERR. The reload
message is not really an "error."
Samples attached. The avc messages generated by the X server have
X-specific fields in them:
request (X protocol request name)
comm (program name)
client (X client number)
xdevice (name of X device)
resid (X resource ID)
restype (X resource type)
event (X event type)
property (X property name)
selection (X selection name)
extension (X extension name)
If you want these field names changed, for example prefixed with "x",
please let me know.
Can you verify that the X server was able to create the audit socket
successfully?
Yes, because when I actually install the audit package, things started
appearing in /var/log/audit/audit.log. I did not have the audit package
installed. Why isn't it redirecting to /var/log/messages in this case?
It should be if you have audit enabled. Perhaps you didn't boot with audit=1?
No, I didn't have this flag set.
--
Eamon Walsh <ewalsh@xxxxxxxxxxxxx>
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
