From: russell@coker.com.au (Russell Coker)
Date: Thu, 26 Jun 2014 21:20:18 +1000
Subject: [refpolicy] strange systemctl audit messages
Message-ID: <1552420.sQKKNUdSRH@xev>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

type=USER_AVC msg=audit(1403767163.112:2422): pid=1 uid=0 auid=4294967295 
ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { stop } 
for auid=0 uid=0 gid=0 path="/dev/null" cmdline="systemctl stop udev.service 
udev-control.socket udev-kernel.socket" 
scontext=unconfined_u:unconfined_r:dpkg_script_t:s0-s0:c0.c1023 
tcontext=system_u:object_r:null_device_t:s0 tclass=service  
exe="/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'                                                                                                                                                                                                                                                             
type=USER_AVC msg=audit(1403767163.116:2423): pid=1 uid=0 auid=4294967295 
ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { status } 
for auid=0 uid=0 gid=0 path="/dev/null" cmdline="systemctl stop udev.service 
udev-control.socket udev-kernel.socket" 
scontext=unconfined_u:unconfined_r:dpkg_script_t:s0-s0:c0.c1023 
tcontext=system_u:object_r:null_device_t:s0 tclass=service  
exe="/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'

What's the cause of these messages?  Why am I seeing an access check on 
null_device_t?

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/