Re: I give up! Help on avc message for dev dm-0

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Gianfranco Durin wrote:
Paul Howarth wrote:
...
I installed the audit package, then after reboot I have

 > # ausearch -a 364

type=USER_AUTH msg=audit(1158759070.643:364): user pid=2593 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c255 msg='PAM: authentication acct=gf : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'

(Not sure if it refers to the previous message, by the way)

It doesn't, because you have rebooted. Are you still getting the denials? If you can find one since the reboot, try the ausearch again and use the number after the ":" in the audit message (364 in the case above).

 > # ls -lZd /var

drwxr-xr-x  root root system_u:object_r:var_t          /var

That one looks OK.

Paul.


I am a little confused.
After rebooting again, I have about 300 messages of the same kind, similar to the first one:

Sep 20 16:16:11 ethan kernel: audit(1158761731.078:308): avc: denied { search } for pid=1359 comm="pam_console_app" name="var" dev=dm-0 ino=130817 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c255 tcontext=system_u:object_r:file_t:s0 tclass=dir

but...

ausearch -a 308

returns
<no matches>

The same for all the others...

Not sure what's going on there. Can you find all matches of 1158761731.078:308 in the log file using grep?

Paul.


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux