How do I figure out on what file dac_override is attempted?

[Daniel J Walsh]

On 01/18/2010 04:59 PM, Göran Uddeborg wrote:
>> Is this a case were we could instument the kernel to give us more
>> information.
> 
> It's just a home machine which I certainly could reboot with a
> separate kernel if desired.  Or did you have something like systemtap
> in mind?  That would be ok too.
> 
> Just to be clear, this machine has some tweaks, and can't be said to
> be "pure".  This issue could very well be because we have broken
> something in the installation.  I'm certainly not claiming this is a
> bug in the policy or any other package at this point.  I'm trying to
> understand what is going on.

My question was more general then just your bug.  It would be good if we had a name. But inode and device would be
a start.

If you use ausearch -m avc to look for this avc, is there some info setroubleshoot might have dropped?