Re: Kernel audit messages

[Russell Coker]

On Tue, 13 Apr 2004 20:36, Mike Chambers <mike(a)netlyncs.com&gt; wrote:
>  I have found these this morning in my logs after the latest kernel
> from
>  rawhide on a FC2T2 system... 
I've attached a new procmail policy, please check it out.

I would like to know what procmail is doing with Perl, is it just for 
spamassasin?  If so then we probably need a domain transition.

In any case we don't want to grant procmail_t access to shadow_t.  Either the 
access is not needed and we can use a dontaudit, or we need to change 
procmail to use unix_chkpwd or some other method of doing whatever it may 
want to do.  It's bad enough that we have to grant RADIUS servers access to 
it!

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page