On 07/22/18 13:32, Samuel Sieb wrote:
On 07/21/2018 10:20 PM, ToddAndMargo wrote:
> On 07/21/2018 06:57 PM, Samuel Sieb wrote:
>> This makes a rule for that specific PID which becomes invalid the next time it
>> starts up. If you've been doing this regularly, I would suggest removing the
old
>> modules.
>
> How do I do that? What modules are you speaking of?
You deleted the part I was quoting:
>> I have an SE Linux alert that keeps coming back and back.
>>
>> # ausearch -c 'geoclue' --raw | audit2allow -M my-geoclue
>> # semodule -X 300 -i my-geoclue.pp
>>
>> Gets rid of it for a day.
Actually, I think I'm wrong. From checking the man page, I see that command
should replace the previous version, so you only have one installed. I think you
can run "semodule -r my-geoclue" to remove the module later. The
"module" is the
selinux policy module that you created and installed with those commands.
I think it bears mentioning that if the alert that is generated is different each
time the program is run due to a different PID that doing install/removal of a local
policy seems a bit tedious.
Since geoclue is supplied by Fedora one would expect it to run without doing that.
So, a BZ should be filed. Yes? Or am I missing something?
--
Conjecture is just a conclusion based on incomplete information. It isn't a fact.