From: eparis@parisplace.org (Eric Paris) Date: Wed, 17 Mar 2010 16:14:56 -0400 Subject: [refpolicy] new: loads of audit messgs In-Reply-To: References: Message-ID: <7e0fb38c1003171314v6d1ab81fv6ac7a9556dfddd1@mail.gmail.com> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com #define AUDIT_USER_AVC 1107 /* We filter this differently */ So some userspace object manager is denying something ?dbus? not sure what to tell you since you only get part of the message.... -Eric On Tue, Mar 16, 2010 at 9:04 PM, Justin Mattock wrote: > this is new: > (log message is showing loads of these,but I don't see this getting in > the way of anything). > > ?type=1107 audit(1268786484.482:3): user pid=1277 uid=0 > auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 > msg='' > [ ? ?8.482858] type=1107 audit(1268786484.482:4): user pid=1277 uid=0 > auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 > msg='' > [ ? ?8.514268] type=1107 audit(1268786484.514:5): user pid=1277 uid=0 > auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 > msg='' > [ ? ?8.514803] type=1107 audit(1268786484.514:6): user pid=1277 uid=0 > auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 > msg='' > [ ? ?8.515396] type=1107 audit(1268786484.515:7): user pid=1277 uid=0 > auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 > msg='' > [ ? ?8.515891] type=1107 audit(1268786484.515:8): user pid=1277 uid=0 > auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 > msg='' > > I'll have a look tomorrow to see if this is kernel, and/or policy > only change I did was update libc,kernel(add ima integrity) > and add fcron/logrotate with pam support. > > any ideas? > > -- > Justin P. Mattock > > -- > This message was distributed to subscribers of the selinux mailing list. > If you no longer wish to subscribe, send mail to majordomo at tycho.nsa.gov with > the words "unsubscribe selinux" without quotes as the message. >