Hi,

thanks to Steve Grubb I figured out how to make setroubleshootd start as
an auditd plugin.
with the two files attached (plugin conf and selinux module) it should
be a little faster in boot (see attached bootchart).

Anyone wants to bring that into the setroubleshoot/audit pkg?

regards

christoph

policy_module(auditd-troubled,0.1)

gen_require(` type setroubleshootd_exec_t; ')
gen_require(` type setroubleshootd_t; ')
gen_require(` type audisp_t; ')

allow audisp_t setroubleshootd_exec_t:file read_file_perms;
allow audisp_t setroubleshootd_exec_t:file execute;
domain_auto_trans(audisp_t, setroubleshootd_exec_t, setroubleshootd_t)
corecmd_exec_bin(audisp_t)
allow setroubleshootd_t audisp_t:unix_stream_socket { ioctl read write };
allow audisp_t setroubleshootd_trocess signal;
active = yes
direction = out
path = /usr/sbin/setroubleshootd
type = always
args = -f
format = string
--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list