Why does the dbus-daemon want to read the cmdline of every process that it
talks to? Is it something to allow or dontaudit? It appears to work without
allowing it.
type=AVC msg=audit(1236168464.840:83): avc: denied { search } for pid=2757
comm="dbus-daemon" name="2874" dev=proc ino=12535
scontext=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir
type=AVC msg=audit(1236168464.840:83): avc: denied { read } for pid=2757
comm="dbus-daemon" name="cmdline" dev=proc ino=12536
scontext=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file
type=SYSCALL msg=audit(1236168464.840:83): arch=40000003 syscall=5 success=yes
exit=16 a0=b8481fa0 a1=0 a2=b3a a3=b84826c0 items=0 ppid=1 pid=2757
auid=4294967295 uid=103 gid=105 euid=103 suid=103 fsuid=103 egid=105 sgid=105
fsgid=105 tty=(none) ses=4294967295 comm="dbus-daemon"
exe="/usr/bin/dbus-daemon"
subj=unconfined_u:unconfined_r:system_dbusd_t:s0-s0:c0.c1023 key=(null)
--
russell@xxxxxxxxxxxx
http://etbe.coker.com.au/ My Main Blog
http://doc.coker.com.au/ My Documents Blog
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
