AVCs generated by oom actions....

[Tom London]

I'm having some out-of-memory issues with latest kernels:
https://bugzilla.redhat.com/show_bug.cgi?id=460848

I've noticed that when this happens, I get audit and AVC spew.

Appears that I get 'sys_rawio', 'sys_admin', and 'sys_resource' AVCs
for processes that are about to commit suicide.

I have no idea what is causing these, and whether these are bugs (or
features ;)).

Any ideas/wisdom welcome!

tom

[root at tlondon ~]# audit2allow -i oom-audit.txt


#============= NetworkManager_t ==============
allow NetworkManager_t self:capability { sys_rawio sys_admin sys_resource };

#============= audisp_t ==============
allow audisp_t self:capability { sys_rawio sys_admin sys_resource };

#============= auditd_t ==============
allow auditd_t self:capability { sys_rawio sys_admin };

#============= bluetooth_t ==============
allow bluetooth_t self:capability { sys_rawio sys_admin sys_resource };

#============= consolekit_t ==============
allow consolekit_t self:capability { sys_rawio sys_admin sys_resource };

#============= dhcpc_t ==============
allow dhcpc_t self:capability { sys_rawio sys_admin };

#============= getty_t ==============
allow getty_t self:capability sys_rawio;

#============= kerneloops_t ==============
allow kerneloops_t self:capability { sys_rawio sys_admin sys_resource };

#============= restorecond_t ==============
allow restorecond_t self:capability { sys_rawio sys_admin sys_resource };

#============= rpcd_t ==============
allow rpcd_t self:capability { sys_rawio sys_admin sys_resource };

#============= sendmail_t ==============
allow sendmail_t self:capability { sys_rawio sys_admin sys_resource };

#============= setroubleshootd_t ==============
allow setroubleshootd_t self:capability { sys_rawio sys_admin sys_resource };

#============= sshd_t ==============
allow sshd_t self:capability { sys_rawio sys_admin };

#============= syslogd_t ==============
allow syslogd_t self:capability sys_rawio;

#============= unconfined_mono_t ==============
allow unconfined_mono_t self:process execstack;

#============= xdm_t ==============
allow xdm_t self:capability sys_admin;
[root at tlondon ~]#

-- 
Tom London