From:   Russell Coker <russell@coker.com.au>
To:     "Sugar, David" <dsugar@tresys.com>
Reply-To: russell@coker.com.au
Cc:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: [PATCH 3/3] Some items that seem they can be dontaudited for plymouthd
Date:   Sat, 13 Apr 2019 14:24:25 +1000
Message-ID: <14839769.DdiKdgLD4o@xev>
In-Reply-To: <a539292f-7396-acb3-cb5e-e3415d5cf861@tresys.com>
References: <20190412193917.23886-1-dsugar@tresys.com> <2319520.MOiGnKPAe5@liv> <a539292f-7396-acb3-cb5e-e3415d5cf861@tresys.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On Saturday, 13 April 2019 1:26:06 PM AEST Sugar, David wrote:
> On 4/12/19 10:33 PM, Russell Coker wrote:
> > What is netlink_kobject_uevent_socket?  Do we have a place we can document
> > this sort of thing to make it easier to determine whether access is
> > required and what the implications of such access are?
> 
> I'm really not sure either.  But, please note, that this patch is
> dontaudit rules to quiet some denials that didn't seem to have any
> negative side effect.  If this patch isn't applied things will still
> function, just have some entries in the audit logs.

There's a good chance the action in question isn't an accident and some aspect 
of the program's functionality will be changed.  I think it's best to have an 
idea of what the issue was before putting in a dontaudit rule, if some 
configuration of that program actually needs such functionality then a 
dontaudit will make it inconvenient to track it down.

Have you tried running strace or ltrace to see what it's doing?

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/