[root@frank-01 ~]# audit2allow -M local < /tmp/avcs -bash: /tmp/avcs: No such file or directory
Where to go next.
The logs are mailed to "root@localhost" by exim.
What and where need to be allowed.
Have already done a /sbin/fixfiles relabel. (mislabelled stuff)
To allow for future logs?
Frank
On Mon, Jul 7, 2008 at 11:02 AM, Frank Murphy frankly3d@gmail.com wrote:
[root@frank-01 ~]# audit2allow -M local < /tmp/avcs -bash: /tmp/avcs: No such file or directory
Where to go next.
The logs are mailed to "root@localhost" by exim.
What and where need to be allowed.
Have already done a /sbin/fixfiles relabel. (mislabelled stuff)
To allow for future logs?
/tmp/avcs ?? The logs are either in /var/log/audit.log (if audit is running) otherwise in syslog (in this case passing -D to audit2allow will use them)
On Mon, 2008-07-07 at 11:08 +0200, drago01 wrote:
On Mon, Jul 7, 2008 at 11:02 AM, Frank Murphy frankly3d@gmail.com wrote:
[root@frank-01 ~]# audit2allow -M local < /tmp/avcs -bash: /tmp/avcs: No such file or directory
Where to go next.
The logs are mailed to "root@localhost" by exim.
What and where need to be allowed.
Have already done a /sbin/fixfiles relabel. (mislabelled stuff)
To allow for future logs?
/tmp/avcs ??
I took that verbatim from faq, rather new to this selinux thingey.
The logs are either in /var/log/audit.log (if audit is running) otherwise in syslog (in this case passing -D to audit2allow will use them)
audit2allow /var/log/audit/audit.log?
Frank
On Mon, Jul 7, 2008 at 11:13 AM, Frank Murphy frankly3d@gmail.com wrote:
On Mon, 2008-07-07 at 11:08 +0200, drago01 wrote:
On Mon, Jul 7, 2008 at 11:02 AM, Frank Murphy frankly3d@gmail.com wrote:
[root@frank-01 ~]# audit2allow -M local < /tmp/avcs -bash: /tmp/avcs: No such file or directory
Where to go next.
The logs are mailed to "root@localhost" by exim.
What and where need to be allowed.
Have already done a /sbin/fixfiles relabel. (mislabelled stuff)
To allow for future logs?
/tmp/avcs ??
I took that verbatim from faq, rather new to this selinux thingey.
The logs are either in /var/log/audit.log (if audit is running) otherwise in syslog (in this case passing -D to audit2allow will use them)
audit2allow /var/log/audit/audit.log?
yes just use this file instead of /tmp/avcs audit2allow -M local < /your/log/file
On Mon, 2008-07-07 at 11:27 +0200, drago01 wrote:
The logs are either in /var/log/audit.log (if audit is running) otherwise in syslog (in this case passing -D to audit2allow will use them)
audit2allow /var/log/audit/audit.log?
yes just use this file instead of /tmp/avcs audit2allow -M local < /your/log/file
How long mush one give to the command? I cleared the log, waited for two avc alerts. ran: [root@frank-03 ~]# audit2allow -M local /var/log/audit/audit.log
It's been an hour so far.
Frank
Frank Murphy wrote:
On Mon, 2008-07-07 at 11:27 +0200, drago01 wrote:
The logs are either in /var/log/audit.log (if audit is running) otherwise in syslog (in this case passing -D to audit2allow will use them)
audit2allow /var/log/audit/audit.log?
yes just use this file instead of /tmp/avcs audit2allow -M local < /your/log/file
How long mush one give to the command? I cleared the log, waited for two avc alerts. ran: [root@frank-03 ~]# audit2allow -M local /var/log/audit/audit.log
It's been an hour so far.
What you typed isn't what was suggested. You missed the "<".
It's waiting for the end of file on stdin, which is your terminal.
Paul.
On Tue, 2008-07-08 at 09:37 +0100, Paul Howarth wrote:
Frank Murphy wrote:
audit2allow -M local < /your/log/file
ran: [root@frank-03 ~]# audit2allow -M local /var/log/audit/audit.log
It's been an hour so far.
What you typed isn't what was suggested. You missed the "<".
It's waiting for the end of file on stdin, which is your terminal.
Paul.
Good job the eye test is tomorrow ;(
Frank
selinux@lists.fedoraproject.org