Description of problem: I had a avc deny: avc: denied { read, write } for comm="dbus-daemon" dev=dm-0 egid=0 euid=0 exe="/bin/dbus-daemon" exit=4 fsgid=0 fsuid=0 gid=0 items=0 name="vas_misc.vdb" pid=4491 scontext=user_u:system_r:system_dbusd_t:s0 sgid=0 subj=user_u:system_r:system_dbusd_t:s0 suid=0 tclass=file tcontext=user_u:object_r:var_t:s0 tty=pts3 uid=0 which I ran audit2allow on and got: #============= system_dbusd_t ============== allow system_dbusd_t var_t:file { write read, }; which has an extra , after the read so there is a syntax error when you then use checkmodule. Version-Release number of selected component (if applicable): policycoreutils-2.0.16-11.fc7 How reproducible: Run audit2allow on something with a comma separated list, and it happens. Steps to reproduce: audit2allow avc: denied { read, write } for comm="dbus-daemon" dev=dm-0 egid=0 euid=0 exe="/bin/dbus-daemon" exit=4 fsgid=0 fsuid=0 gid=0 items=0 name="vas_misc.vdb" pid=4491 scontext=user_u:system_r:system_dbusd_t:s0 sgid=0 subj=user_u:system_r:system_dbusd_t:s0 suid=0 tclass=file tcontext=user_u:object_r:var_t:s0 tty=pts3 uid=0 Actual results: #============= system_dbusd_t ============== allow system_dbusd_t var_t:file { write read, }; Expected results: #============= system_dbusd_t ============== allow system_dbusd_t var_t:file { write read };
I see this as more of a kernel error. The AVC is the wrong format. While, we can fix the audit2allow message, the kernel also needs to be fixed.
where did the malformed avc denial come from? dmesg? audit.log? setroubleshoot gui? While I agree with dan the problem isn't with audit2allow it is with the message itself, I can't find who would be generating a message with a comma in it.
This output comes from setroubleshoot.
Created attachment 186431 [details] Patch to fix output
Fixed, thanks for the report, thanks for the patch. BTW, I've rewritten the interface to the audit system and we're now capturing the exact audit lines and keeping audit records in event seperate to avoid any information loss in the audit data. This has not yet been fully plumbed to extend the data to the AVC class though, but when it is the audit data in the alert will be one for one exact and not a modified processed version.