Wrong audit message type when policy is reloaded
Hi,
When the policy is reloaded, systemd and dbus are sending a USER_AVC audit event instead of a USER_MAC_POLICY_LOAD one.
Looking at an other object manager (the xserver) it uses the following code: http://cgit.freedesktop.org/xorg/xserver/tree/Xext/xselinux_hooks.c#n300
Can we really link SELINUX_INFO to AUDIT_USER_MAC_POLICY_LOAD? Is there a better way to achieve this?
An downstream bug has been opened: https://bugzilla.redhat.com/show_bug.cgi?id=1195330
Cheers,
Laurent Bigonville
Quoted 9 lines · Laurent Bigonville
Hi,
When the policy is reloaded, systemd and dbus are sending a
USER_AVCaudit event instead of aUSER_MAC_POLICY_LOADone.Looking at an other object manager (the xserver) it uses the following code:
http://cgit.freedesktop.org/xorg/xserver/tree/Xext/xselinux_hooks.c#n300
Quoted 5 lines
Can we really link
SELINUX_INFOtoAUDIT_USER_MAC_POLICY_LOAD? Is there a better way to achieve this?An downstream bug has been opened:
https://bugzilla.redhat.com/show_bug.cgi?id=1195330
I think when they introduced the audit support, they should have added a new type value in libselinux for MAC_POLICY_LOAD, and then they could have handled this cleanly in their callback functions. That is what I would do. I guess now we have to figure out how to do so compatibly...
I guess I should have CCed the linux-audit mailing list from the start.
As said in my initial mail (see bellow) wheb SELinux user object manager are reloading the policy, an audit message with a wrong type is logged USER_AVC vs USER_MAC_POLICY_LOAD.
Quoted 19 lines · Stephen Smalley
Quoted 9 lines · Laurent Bigonville
Hi,
When the policy is reloaded, systemd and dbus are sending a
USER_AVCaudit event instead of aUSER_MAC_POLICY_LOADone.Looking at an other object manager (the xserver) it uses the following code:
http://cgit.freedesktop.org/xorg/xserver/tree/Xext/xselinux_hooks.c#n300Quoted 5 lines
Can we really link
SELINUX_INFOtoAUDIT_USER_MAC_POLICY_LOAD? Is there a better way to achieve this?An downstream bug has been opened:
https://bugzilla.redhat.com/show_bug.cgi?id=1195330I think when they introduced the audit support, they should have added a new type value in libselinux for
MAC_POLICY_LOAD, and then they could have handled this cleanly in their callback functions. That is what I would do. I guess now we have to figure out how to do so compatibly...