Re: Unable to use audit2allow on avc denials

[birdynam]

Yep your right,

i just wanted to point the fact that even if the logs are in messages
instead of audit.log, audit2allow can be used (related to Wilkinson
Matthew post).

Birdy.

Unable to use audit2allow on avc denials

[Wilkinson, Matthew]

I figured it out. Once I got auditd running again, I was able to use audit2allow to get the right policies from SELinux. Once I did that, rsyslogd could read the logs in /var/named/data/

--Matthew Wilkinson

-----Original Message-----
From: birdynam [mailto:[e-mail]] 
Sent: Friday, September 22, 2017 12:41
To: [e-mail]
Subject: Re: Unable to use audit2allow on avc denials

[This is an external email. Be cautious with links, attachments and responses.]

**********************************************************************
Yep your right,

i just wanted to point the fact that even if the logs are in messages instead of audit.log, audit2allow can be used (related to Wilkinson Matthew post).

Birdy.
_______________________________________________
selinux mailing list -- [e-mail] To unsubscribe send an email to [e-mail]

Unable to use audit2allow on avc denials

[Simon Sekidde]

Matthew,

Just to make sure I understand this correctly, rsyslogd has been granted permission to read all the various statistics and debugging files stored in /var/named/data/

----- Original Message -----
> From: "Matthew Wilkinson" 
> To: "birdynam" , [e-mail]
> Sent: Friday, September 22, 2017 1:54:38 PM
> Subject: RE: Unable to use audit2allow on avc denials
>
> I figured it out. Once I got auditd running again, I was able to use
> audit2allow to get the right policies from SELinux. Once I did that,
> rsyslogd could read the logs in /var/named/data/
>
> --Matthew Wilkinson
>
> -----Original Message-----
> From: birdynam [mailto:[e-mail]]
> Sent: Friday, September 22, 2017 12:41
> To: [e-mail]
> Subject: Re: Unable to use audit2allow on avc denials
>
> [This is an external email. Be cautious with links, attachments and
> responses.]
>
> Yep your right,
>
> i just wanted to point the fact that even if the logs are in messages instead
> of audit.log, audit2allow can be used (related to Wilkinson Matthew post).
>
> Birdy.
> _______________________________________________
> selinux mailing list -- [e-mail] To unsubscribe send
> an email to [e-mail]
> _______________________________________________
> selinux mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]