Attachment 311501 Details for Bug 452738 – sealert output

sealert output

procmail.log (text/plain), 23.42 KB, created by Carl Roth on 2008-07-10 18:21:29 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Carl Roth

Created: 2008-07-10 18:21:29 UTC

Size: 23.42 KB

patch

obsolete

>
>Summary:
>
>SELinux is preventing spamd (spamd_t) "read" to ./razor (razor_var_lib_t).
>
>Detailed Description:
>
>[SELinux is in permissive mode, the operation would have been denied but was
>permitted due to permissive mode.]
>
>SELinux denied access requested by spamd. It is not expected that this access is
>required by spamd and this access may signal an intrusion attempt. It is also
>possible that the specific version or configuration of the application is
>causing it to require additional access.
>
>Allowing Access:
>
>Sometimes labeling problems can cause SELinux denials. You could try to restore
>the default system file context for ./razor,
>
>restorecon -v './razor'
>
>If this does not work, there is currently no automatic way to allow this access.
>Instead, you can generate a local policy module to allow this access - see FAQ
>(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
>SELinux protection altogether. Disabling SELinux protection is not recommended.
>Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
>against this package.
>
>Additional Information:
>
>Source Context                system_u:system_r:spamd_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:razor_var_lib_t:s0
>Target Objects                ./razor [ dir ]
>Source                        spamd
>Source Path                   /usr/bin/perl
>Port                          <Unknown>
>Host                          theo.ursus.net
>Source RPM Packages           perl-5.10.0-30.fc9
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.3.1-74.fc9
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   catchall_file
>Host Name                     theo.ursus.net
>Platform                      Linux theo.ursus.net 2.6.25.9-76.fc9.i686 #1 SMP
>                              Fri Jun 27 16:14:35 EDT 2008 i686 i686
>Alert Count                   1
>First Seen                    Thu Jul 10 11:10:16 2008
>Last Seen                     Thu Jul 10 11:10:16 2008
>Local ID                      0f7a0bd4-2ebd-45fc-89d4-95703974e880
>Line Numbers                  
>
>Raw Audit Messages            
>
>host=theo.ursus.net type=AVC msg=audit(1215713416.288:90370): avc:  denied  { read } for  pid=11481 comm="spamd" name="razor" dev=dm-7 ino=1032415 scontext=system_u:system_r:spamd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:razor_var_lib_t:s0 tclass=dir
>
>host=theo.ursus.net type=SYSCALL msg=audit(1215713416.288:90370): arch=40000003 syscall=5 success=yes exit=12 a0=b6e6304 a1=98800 a2=2 a3=a6ef104 items=0 ppid=11446 pid=11481 auid=0 uid=0 gid=0 euid=500 suid=0 fsuid=500 egid=500 sgid=0 fsgid=500 tty=(none) ses=9600 comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0-s0:c0.c1023 key=(null)
>
>
>
>
>Summary:
>
>SELinux is preventing spamd (spamd_t) "getattr" to
>/var/lib/razor/servers.discovery.lst (razor_var_lib_t).
>
>Detailed Description:
>
>[SELinux is in permissive mode, the operation would have been denied but was
>permitted due to permissive mode.]
>
>SELinux denied access requested by spamd. It is not expected that this access is
>required by spamd and this access may signal an intrusion attempt. It is also
>possible that the specific version or configuration of the application is
>causing it to require additional access.
>
>Allowing Access:
>
>Sometimes labeling problems can cause SELinux denials. You could try to restore
>the default system file context for /var/lib/razor/servers.discovery.lst,
>
>restorecon -v '/var/lib/razor/servers.discovery.lst'
>
>If this does not work, there is currently no automatic way to allow this access.
>Instead, you can generate a local policy module to allow this access - see FAQ
>(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
>SELinux protection altogether. Disabling SELinux protection is not recommended.
>Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
>against this package.
>
>Additional Information:
>
>Source Context                system_u:system_r:spamd_t:s0-s0:c0.c1023
>Target Context                unconfined_u:object_r:razor_var_lib_t:s0
>Target Objects                /var/lib/razor/servers.discovery.lst [ file ]
>Source                        spamd
>Source Path                   /usr/bin/perl
>Port                          <Unknown>
>Host                          theo.ursus.net
>Source RPM Packages           perl-5.10.0-30.fc9
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.3.1-74.fc9
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   catchall_file
>Host Name                     theo.ursus.net
>Platform                      Linux theo.ursus.net 2.6.25.9-76.fc9.i686 #1 SMP
>                              Fri Jun 27 16:14:35 EDT 2008 i686 i686
>Alert Count                   1
>First Seen                    Thu Jul 10 11:10:16 2008
>Last Seen                     Thu Jul 10 11:10:16 2008
>Local ID                      d8733554-2ddf-408e-9f87-fb0750adba2d
>Line Numbers                  
>
>Raw Audit Messages            
>
>host=theo.ursus.net type=AVC msg=audit(1215713416.277:90369): avc:  denied  { getattr } for  pid=11481 comm="spamd" path="/var/lib/razor/servers.discovery.lst" dev=dm-7 ino=1032417 scontext=system_u:system_r:spamd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:razor_var_lib_t:s0 tclass=file
>
>host=theo.ursus.net type=SYSCALL msg=audit(1215713416.277:90369): arch=40000003 syscall=197 success=yes exit=0 a0=c a1=984d060 a2=275ff4 a3=0 items=0 ppid=11446 pid=11481 auid=0 uid=0 gid=0 euid=500 suid=0 fsuid=500 egid=500 sgid=0 fsgid=500 tty=(none) ses=9600 comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0-s0:c0.c1023 key=(null)
>
>
>
>
>Summary:
>
>SELinux is preventing spamd (spamd_t) "ioctl" to
>/var/lib/razor/servers.discovery.lst (razor_var_lib_t).
>
>Detailed Description:
>
>[SELinux is in permissive mode, the operation would have been denied but was
>permitted due to permissive mode.]
>
>SELinux denied access requested by spamd. It is not expected that this access is
>required by spamd and this access may signal an intrusion attempt. It is also
>possible that the specific version or configuration of the application is
>causing it to require additional access.
>
>Allowing Access:
>
>Sometimes labeling problems can cause SELinux denials. You could try to restore
>the default system file context for /var/lib/razor/servers.discovery.lst,
>
>restorecon -v '/var/lib/razor/servers.discovery.lst'
>
>If this does not work, there is currently no automatic way to allow this access.
>Instead, you can generate a local policy module to allow this access - see FAQ
>(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
>SELinux protection altogether. Disabling SELinux protection is not recommended.
>Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
>against this package.
>
>Additional Information:
>
>Source Context                system_u:system_r:spamd_t:s0-s0:c0.c1023
>Target Context                unconfined_u:object_r:razor_var_lib_t:s0
>Target Objects                /var/lib/razor/servers.discovery.lst [ file ]
>Source                        spamd
>Source Path                   /usr/bin/perl
>Port                          <Unknown>
>Host                          theo.ursus.net
>Source RPM Packages           perl-5.10.0-30.fc9
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.3.1-74.fc9
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   catchall_file
>Host Name                     theo.ursus.net
>Platform                      Linux theo.ursus.net 2.6.25.9-76.fc9.i686 #1 SMP
>                              Fri Jun 27 16:14:35 EDT 2008 i686 i686
>Alert Count                   1
>First Seen                    Thu Jul 10 11:10:16 2008
>Last Seen                     Thu Jul 10 11:10:16 2008
>Local ID                      4184fac2-b01a-4440-8d71-2767bed46003
>Line Numbers                  
>
>Raw Audit Messages            
>
>host=theo.ursus.net type=AVC msg=audit(1215713416.276:90368): avc:  denied  { ioctl } for  pid=11481 comm="spamd" path="/var/lib/razor/servers.discovery.lst" dev=dm-7 ino=1032417 scontext=system_u:system_r:spamd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:razor_var_lib_t:s0 tclass=file
>
>host=theo.ursus.net type=SYSCALL msg=audit(1215713416.276:90368): arch=40000003 syscall=54 success=no exit=-25 a0=c a1=5401 a2=bff74618 a3=bff74658 items=0 ppid=11446 pid=11481 auid=0 uid=0 gid=0 euid=500 suid=0 fsuid=500 egid=500 sgid=0 fsgid=500 tty=(none) ses=9600 comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0-s0:c0.c1023 key=(null)
>
>
>
>
>Summary:
>
>SELinux is preventing spamd (spamd_t) "read" to ./servers.discovery.lst
>(razor_var_lib_t).
>
>Detailed Description:
>
>[SELinux is in permissive mode, the operation would have been denied but was
>permitted due to permissive mode.]
>
>SELinux denied access requested by spamd. It is not expected that this access is
>required by spamd and this access may signal an intrusion attempt. It is also
>possible that the specific version or configuration of the application is
>causing it to require additional access.
>
>Allowing Access:
>
>Sometimes labeling problems can cause SELinux denials. You could try to restore
>the default system file context for ./servers.discovery.lst,
>
>restorecon -v './servers.discovery.lst'
>
>If this does not work, there is currently no automatic way to allow this access.
>Instead, you can generate a local policy module to allow this access - see FAQ
>(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
>SELinux protection altogether. Disabling SELinux protection is not recommended.
>Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
>against this package.
>
>Additional Information:
>
>Source Context                system_u:system_r:spamd_t:s0-s0:c0.c1023
>Target Context                unconfined_u:object_r:razor_var_lib_t:s0
>Target Objects                ./servers.discovery.lst [ file ]
>Source                        spamd
>Source Path                   /usr/bin/perl
>Port                          <Unknown>
>Host                          theo.ursus.net
>Source RPM Packages           perl-5.10.0-30.fc9
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.3.1-74.fc9
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   catchall_file
>Host Name                     theo.ursus.net
>Platform                      Linux theo.ursus.net 2.6.25.9-76.fc9.i686 #1 SMP
>                              Fri Jun 27 16:14:35 EDT 2008 i686 i686
>Alert Count                   1
>First Seen                    Thu Jul 10 11:10:16 2008
>Last Seen                     Thu Jul 10 11:10:16 2008
>Local ID                      aecd0700-3695-4a9a-863f-e54116404dd8
>Line Numbers                  
>
>Raw Audit Messages            
>
>host=theo.ursus.net type=AVC msg=audit(1215713416.276:90367): avc:  denied  { read } for  pid=11481 comm="spamd" name="servers.discovery.lst" dev=dm-7 ino=1032417 scontext=system_u:system_r:spamd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:razor_var_lib_t:s0 tclass=file
>
>host=theo.ursus.net type=SYSCALL msg=audit(1215713416.276:90367): arch=40000003 syscall=5 success=yes exit=12 a0=b593554 a1=8000 a2=0 a3=8000 items=0 ppid=11446 pid=11481 auid=0 uid=0 gid=0 euid=500 suid=0 fsuid=500 egid=500 sgid=0 fsgid=500 tty=(none) ses=9600 comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0-s0:c0.c1023 key=(null)
>
>
>
>
>Summary:
>
>SELinux is preventing spamd (spamd_t) "getattr" to /var/lib/razor
>(razor_var_lib_t).
>
>Detailed Description:
>
>[SELinux is in permissive mode, the operation would have been denied but was
>permitted due to permissive mode.]
>
>SELinux denied access requested by spamd. It is not expected that this access is
>required by spamd and this access may signal an intrusion attempt. It is also
>possible that the specific version or configuration of the application is
>causing it to require additional access.
>
>Allowing Access:
>
>Sometimes labeling problems can cause SELinux denials. You could try to restore
>the default system file context for /var/lib/razor,
>
>restorecon -v '/var/lib/razor'
>
>If this does not work, there is currently no automatic way to allow this access.
>Instead, you can generate a local policy module to allow this access - see FAQ
>(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
>SELinux protection altogether. Disabling SELinux protection is not recommended.
>Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
>against this package.
>
>Additional Information:
>
>Source Context                system_u:system_r:spamd_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:razor_var_lib_t:s0
>Target Objects                /var/lib/razor [ dir ]
>Source                        spamd
>Source Path                   /usr/bin/perl
>Port                          <Unknown>
>Host                          theo.ursus.net
>Source RPM Packages           perl-5.10.0-30.fc9
>Target RPM Packages           ursus-config-razor-1.0.83-0.urs.1.fc9
>Policy RPM                    selinux-policy-3.3.1-74.fc9
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   catchall_file
>Host Name                     theo.ursus.net
>Platform                      Linux theo.ursus.net 2.6.25.9-76.fc9.i686 #1 SMP
>                              Fri Jun 27 16:14:35 EDT 2008 i686 i686
>Alert Count                   1
>First Seen                    Thu Jul 10 11:10:16 2008
>Last Seen                     Thu Jul 10 11:10:16 2008
>Local ID                      ba685091-d10f-4e99-8d5d-3e51b092cda7
>Line Numbers                  
>
>Raw Audit Messages            
>
>host=theo.ursus.net type=AVC msg=audit(1215713416.273:90366): avc:  denied  { getattr } for  pid=11481 comm="spamd" path="/var/lib/razor" dev=dm-7 ino=1032415 scontext=system_u:system_r:spamd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:razor_var_lib_t:s0 tclass=dir
>
>host=theo.ursus.net type=SYSCALL msg=audit(1215713416.273:90366): arch=40000003 syscall=195 success=yes exit=0 a0=a5c7434 a1=984d0c0 a2=275ff4 a3=a5c7434 items=0 ppid=11446 pid=11481 auid=0 uid=0 gid=0 euid=500 suid=0 fsuid=500 egid=500 sgid=0 fsgid=500 tty=(none) ses=9600 comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0-s0:c0.c1023 key=(null)
>
>
>
>
>Summary:
>
>SELinux is preventing spamd (spamd_t) "ioctl" to /var/lib/razor/razor-agent.conf
>(razor_var_lib_t).
>
>Detailed Description:
>
>[SELinux is in permissive mode, the operation would have been denied but was
>permitted due to permissive mode.]
>
>SELinux denied access requested by spamd. It is not expected that this access is
>required by spamd and this access may signal an intrusion attempt. It is also
>possible that the specific version or configuration of the application is
>causing it to require additional access.
>
>Allowing Access:
>
>Sometimes labeling problems can cause SELinux denials. You could try to restore
>the default system file context for /var/lib/razor/razor-agent.conf,
>
>restorecon -v '/var/lib/razor/razor-agent.conf'
>
>If this does not work, there is currently no automatic way to allow this access.
>Instead, you can generate a local policy module to allow this access - see FAQ
>(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
>SELinux protection altogether. Disabling SELinux protection is not recommended.
>Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
>against this package.
>
>Additional Information:
>
>Source Context                system_u:system_r:spamd_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:razor_var_lib_t:s0
>Target Objects                /var/lib/razor/razor-agent.conf [ file ]
>Source                        spamd
>Source Path                   /usr/bin/perl
>Port                          <Unknown>
>Host                          theo.ursus.net
>Source RPM Packages           perl-5.10.0-30.fc9
>Target RPM Packages           ursus-config-razor-1.0.83-0.urs.1.fc9
>Policy RPM                    selinux-policy-3.3.1-74.fc9
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   catchall_file
>Host Name                     theo.ursus.net
>Platform                      Linux theo.ursus.net 2.6.25.9-76.fc9.i686 #1 SMP
>                              Fri Jun 27 16:14:35 EDT 2008 i686 i686
>Alert Count                   1
>First Seen                    Thu Jul 10 11:10:16 2008
>Last Seen                     Thu Jul 10 11:10:16 2008
>Local ID                      fd470c84-67c0-4703-9a8e-4d465093fe92
>Line Numbers                  
>
>Raw Audit Messages            
>
>host=theo.ursus.net type=AVC msg=audit(1215713416.243:90365): avc:  denied  { ioctl } for  pid=11481 comm="spamd" path="/var/lib/razor/razor-agent.conf" dev=dm-7 ino=1032426 scontext=system_u:system_r:spamd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:razor_var_lib_t:s0 tclass=file
>
>host=theo.ursus.net type=SYSCALL msg=audit(1215713416.243:90365): arch=40000003 syscall=54 success=no exit=-25 a0=c a1=5401 a2=bff74618 a3=bff74658 items=0 ppid=11446 pid=11481 auid=0 uid=0 gid=0 euid=500 suid=0 fsuid=500 egid=500 sgid=0 fsgid=500 tty=(none) ses=9600 comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0-s0:c0.c1023 key=(null)
>
>
>
>
>Summary:
>
>SELinux is preventing spamd (spamd_t) "read" to ./razor-agent.conf
>(razor_var_lib_t).
>
>Detailed Description:
>
>[SELinux is in permissive mode, the operation would have been denied but was
>permitted due to permissive mode.]
>
>SELinux denied access requested by spamd. It is not expected that this access is
>required by spamd and this access may signal an intrusion attempt. It is also
>possible that the specific version or configuration of the application is
>causing it to require additional access.
>
>Allowing Access:
>
>Sometimes labeling problems can cause SELinux denials. You could try to restore
>the default system file context for ./razor-agent.conf,
>
>restorecon -v './razor-agent.conf'
>
>If this does not work, there is currently no automatic way to allow this access.
>Instead, you can generate a local policy module to allow this access - see FAQ
>(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
>SELinux protection altogether. Disabling SELinux protection is not recommended.
>Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
>against this package.
>
>Additional Information:
>
>Source Context                system_u:system_r:spamd_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:razor_var_lib_t:s0
>Target Objects                ./razor-agent.conf [ file ]
>Source                        spamd
>Source Path                   /usr/bin/perl
>Port                          <Unknown>
>Host                          theo.ursus.net
>Source RPM Packages           perl-5.10.0-30.fc9
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.3.1-74.fc9
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   catchall_file
>Host Name                     theo.ursus.net
>Platform                      Linux theo.ursus.net 2.6.25.9-76.fc9.i686 #1 SMP
>                              Fri Jun 27 16:14:35 EDT 2008 i686 i686
>Alert Count                   1
>First Seen                    Thu Jul 10 11:10:16 2008
>Last Seen                     Thu Jul 10 11:10:16 2008
>Local ID                      e3eca6a6-211a-4a55-a0bf-a722c3d0f25f
>Line Numbers                  
>
>Raw Audit Messages            
>
>host=theo.ursus.net type=AVC msg=audit(1215713416.243:90364): avc:  denied  { read } for  pid=11481 comm="spamd" name="razor-agent.conf" dev=dm-7 ino=1032426 scontext=system_u:system_r:spamd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:razor_var_lib_t:s0 tclass=file
>
>host=theo.ursus.net type=SYSCALL msg=audit(1215713416.243:90364): arch=40000003 syscall=5 success=yes exit=12 a0=b59bf64 a1=8000 a2=0 a3=8000 items=0 ppid=11446 pid=11481 auid=0 uid=0 gid=0 euid=500 suid=0 fsuid=500 egid=500 sgid=0 fsgid=500 tty=(none) ses=9600 comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0-s0:c0.c1023 key=(null)
>
>
>
>
>Summary:
>
>SELinux is preventing spamd (spamd_t) "search" to ./razor (razor_var_lib_t).
>
>Detailed Description:
>
>[SELinux is in permissive mode, the operation would have been denied but was
>permitted due to permissive mode.]
>
>SELinux denied access requested by spamd. It is not expected that this access is
>required by spamd and this access may signal an intrusion attempt. It is also
>possible that the specific version or configuration of the application is
>causing it to require additional access.
>
>Allowing Access:
>
>Sometimes labeling problems can cause SELinux denials. You could try to restore
>the default system file context for ./razor,
>
>restorecon -v './razor'
>
>If this does not work, there is currently no automatic way to allow this access.
>Instead, you can generate a local policy module to allow this access - see FAQ
>(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
>SELinux protection altogether. Disabling SELinux protection is not recommended.
>Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
>against this package.
>
>Additional Information:
>
>Source Context                system_u:system_r:spamd_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:razor_var_lib_t:s0
>Target Objects                ./razor [ dir ]
>Source                        spamd
>Source Path                   /usr/bin/perl
>Port                          <Unknown>
>Host                          theo.ursus.net
>Source RPM Packages           perl-5.10.0-30.fc9
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.3.1-74.fc9
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   catchall_file
>Host Name                     theo.ursus.net
>Platform                      Linux theo.ursus.net 2.6.25.9-76.fc9.i686 #1 SMP
>                              Fri Jun 27 16:14:35 EDT 2008 i686 i686
>Alert Count                   1
>First Seen                    Thu Jul 10 11:10:16 2008
>Last Seen                     Thu Jul 10 11:10:16 2008
>Local ID                      f2681ced-8578-4a33-941a-0816e52a2e40
>Line Numbers                  
>
>Raw Audit Messages            
>
>host=theo.ursus.net type=AVC msg=audit(1215713416.239:90363): avc:  denied  { search } for  pid=11481 comm="spamd" name="razor" dev=dm-7 ino=1032415 scontext=system_u:system_r:spamd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:razor_var_lib_t:s0 tclass=dir
>
>host=theo.ursus.net type=AVC msg=audit(1215713416.239:90363): avc:  denied  { getattr } for  pid=11481 comm="spamd" path="/var/lib/razor/razor-agent.conf" dev=dm-7 ino=1032426 scontext=system_u:system_r:spamd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:razor_var_lib_t:s0 tclass=file
>
>host=theo.ursus.net type=SYSCALL msg=audit(1215713416.239:90363): arch=40000003 syscall=195 success=yes exit=0 a0=a5c7434 a1=984d0c0 a2=275ff4 a3=a5c7434 items=0 ppid=11446 pid=11481 auid=0 uid=0 gid=0 euid=500 suid=0 fsuid=500 egid=500 sgid=0 fsgid=500 tty=(none) ses=9600 comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0-s0:c0.c1023 key=(null)
>
>
>

Actions: View

Attachments on bug 452738: 311501