Bug 452044 - Patch - handle 2.6.25+ audit messages
Patch - handle 2.6.25+ audit messages
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: logwatch (Show other bugs)
8
All Linux
low Severity low
: ---
: ---
Assigned To: Ivana Varekova
Fedora Extras Quality Assurance
: Patch
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-06-18 18:33 EDT by Orion Poplawski
Modified: 2008-06-20 06:02 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-06-20 06:02:37 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
patch to audit config and script (2.12 KB, patch)
2008-06-18 18:33 EDT, Orion Poplawski
no flags Details | Diff

  None (edit)
Description Orion Poplawski 2008-06-18 18:33:36 EDT
Description of problem:

It appears that in Linux 2.6.25+ audit messages have a "type=####" field:

May 30 17:10:53 cynosure kernel: type=1400 audit(1212189053.613:2458): avc: 
denied  { read } for  pid=2045 comm="umount" path="/proc/7352/mounts" dev=proc
ino=644101 scontext=unconfined_u:system_r:mount_t:s0
tcontext=unconfined_u:system_r:automount_t:s0 tclass=file


The attached patch address that by changing audit.conf to add the possible type=
field and to remove a leading "^" from one of the rules.

It also handles:

Jun 17 10:39:29 pyramid kernel: audit(1213720769.358:5): user pid=1999 uid=81
auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: 
received policyload notice (seqno=3)

(add support for the added "-s0:c0.c1023")

This has been sent upstream.

Version-Release number of selected component (if applicable):
logwatch-7.3.6-15.fc8
Comment 1 Orion Poplawski 2008-06-18 18:33:36 EDT
Created attachment 309801 [details]
patch to audit config and script
Comment 2 Ivana Varekova 2008-06-20 06:02:37 EDT
Fixed in logwatch-7.3.6-24.fc10.

Note You need to log in before you can comment on or make changes to this bug.