Re: Remove\fix old avc's

[thomas cameron]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/12/2011 12:08 AM, Frank Murphy wrote:
>  on an F16 box, sealert is empty.
>  
>  but:
>  ~$ ausearch -m avc
>  ----
>  time->Sat Oct 29 15:27:51 2011
>  type=SYSCALL msg=audit(1319898471.737:80): arch=c000003e syscall=137 
>  success=no exit=-13 a0=7f725ff344ae a1=7fff730a6850 a2=1000 
>  a3=7fff730a65e0 items=0 ppid=3424 pid=3435 auid=4294967295 uid=0 gid=0 
>  euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 
>  comm="restorecon" exe="/sbin/setfiles" 
>  subj=system_u:system_r:setfiles_t:s0 key=(null)
>  type=AVC msg=audit(1319898471.737:80): avc:  denied  { getattr } for 
>  pid=3435 comm="restorecon" name="/" dev=sysfs ino=1 
>  scontext=system_u:system_r:setfiles_t:s0 
>  tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
>  ----
>  time->Sat Oct 29 15:27:51 2011
>  type=SYSCALL msg=audit(1319898471.902:81): arch=c000003e syscall=137 
>  success=no exit=-13 a0=7ffdb5d014ae a1=7fff2da8f300 a2=1000 a3=0 items=0 
>  ppid=3436 pid=3437 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 
>  egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" 
>  exe="/usr/bin/python" 
>  subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
>  type=AVC msg=audit(1319898471.902:81): avc:  denied  { getattr } for 
>  pid=3437 comm="setroubleshootd" name="/" dev=sysfs ino=1 
>  scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 
>  tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
>  ----
>  time->Sat Oct 29 15:30:43 2011
>  type=SYSCALL msg=audit(1319898643.744:84): arch=c000003e syscall=137 
>  success=no exit=-13 a0=7fc6a4f444ae a1=7fffc431d1c0 a2=1000 a3=0 items=0 
>  ppid=3728 pid=3729 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 
>  egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" 
>  exe="/usr/bin/python" 
>  subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
>  type=AVC msg=audit(1319898643.744:84): avc:  denied  { getattr } for 
>  pid=3729 comm="setroubleshootd" name="/" dev=sysfs ino=1 
>  scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 
>  tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
>  ----
>  time->Sat Oct 29 15:30:43 2011
>  type=SYSCALL msg=audit(1319898643.650:83): arch=c000003e syscall=137 
>  success=no exit=-13 a0=7fd65c6754ae a1=7fff4322e2c0 a2=1000 
>  a3=7fff4322e050 items=0 ppid=1393 pid=3727 auid=4294967295 uid=93 gid=93 
>  euid=0 suid=0 fsuid=0 egid=93 sgid=93 fsgid=93 tty=(none) ses=4294967295 
>  comm="exim" exe="/usr/sbin/exim" subj=system_u:system_r:exim_t:s0
> key=(null)
>  type=AVC msg=audit(1319898643.650:83): avc:  denied  { getattr } for 
>  pid=3727 comm="exim" name="/" dev=sysfs ino=1 
>  scontext=system_u:system_r:exim_t:s0 
>  tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem
>  
>  This box was upgraded from F15,
>  so what do I need do about these avcs'
>  and why they don't show up in sealert.
>  
>  Currently
>  selinux-policy-targeted-3.10.0-51.fc16
>  
>  there seems to be an upgrade available:
>  selinux-policy-targeted-3.10.0-55.fc16
>  
>  will it make any difference to above?
>   
It's almost never a bad idea to update to the latest packages, but I
don't think it will "fix" this issue.

These are just old entries in /var/log/audit/audit.log. You can safely
ignore them or just move the old log files off somewhere else. If *new*
alerts come up, then take appropriate action.

Make sense?

Thomas
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.14 (GNU/Linux)
> Comment: Using GnuPG with Red Hat - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk6+7VQACgkQmzle50YHwaADDgCffT71rohBvmGIcyo/yIAaKunw
> efkAnRPyeiwt1sofIEW0qlp73oZDM5iK
> =BVt9
> -----END PGP SIGNATURE-----