[root@frank-01 ~]# audit2allow -M local < /tmp/avcs
-bash: /tmp/avcs: No such file or directory


Where to go next.

The logs are mailed to "root@localhost" by exim.

What and where need to be allowed.

Have already done a /sbin/fixfiles relabel. (mislabelled stuff)

To allow for future logs?

Frank

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list

On Mon, Jul 7, 2008 at 11:02 AM, Frank Murphy <frankly3d@gmail.com> wrote:
> [root@frank-01 ~]# audit2allow -M local < /tmp/avcs
> -bash: /tmp/avcs: No such file or directory
>
>
> Where to go next.
>
> The logs are mailed to "root@localhost" by exim.
>
> What and where need to be allowed.
>
> Have already done a /sbin/fixfiles relabel. (mislabelled stuff)
>
> To allow for future logs?

/tmp/avcs ??
The logs are either in /var/log/audit.log (if audit is running)
otherwise in syslog (in this case passing -D to audit2allow will use
them)

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list

On Mon, 2008-07-07 at 11:08 +0200, drago01 wrote:
> On Mon, Jul 7, 2008 at 11:02 AM, Frank Murphy <frankly3d@gmail.com> wrote:
> > [root@frank-01 ~]# audit2allow -M local < /tmp/avcs
> > -bash: /tmp/avcs: No such file or directory
> >
> >
> > Where to go next.
> >
> > The logs are mailed to "root@localhost" by exim.
> >
> > What and where need to be allowed.
> >
> > Have already done a /sbin/fixfiles relabel. (mislabelled stuff)
> >
> > To allow for future logs?
>
> /tmp/avcs ??

I took that verbatim from faq, rather new to this selinux thingey.

> The logs are either in /var/log/audit.log (if audit is running)
> otherwise in syslog (in this case passing -D to audit2allow will use
> them)

audit2allow /var/log/audit/audit.log?


Frank

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list

On Mon, Jul 7, 2008 at 11:13 AM, Frank Murphy <frankly3d@gmail.com> wrote:
> On Mon, 2008-07-07 at 11:08 +0200, drago01 wrote:
>> On Mon, Jul 7, 2008 at 11:02 AM, Frank Murphy <frankly3d@gmail.com> wrote:
>> > [root@frank-01 ~]# audit2allow -M local < /tmp/avcs
>> > -bash: /tmp/avcs: No such file or directory
>> >
>> >
>> > Where to go next.
>> >
>> > The logs are mailed to "root@localhost" by exim.
>> >
>> > What and where need to be allowed.
>> >
>> > Have already done a /sbin/fixfiles relabel. (mislabelled stuff)
>> >
>> > To allow for future logs?
>>
>> /tmp/avcs ??
>
> I took that verbatim from faq, rather new to this selinux thingey.
>
>> The logs are either in /var/log/audit.log (if audit is running)
>> otherwise in syslog (in this case passing -D to audit2allow will use
>> them)
>
> audit2allow /var/log/audit/audit.log?

yes just use this file instead of /tmp/avcs
audit2allow -M local < /your/log/file

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list

On Mon, 2008-07-07 at 11:27 +0200, drago01 wrote:

> >> The logs are either in /var/log/audit.log (if audit is running)
> >> otherwise in syslog (in this case passing -D to audit2allow will use
> >> them)
> >
> > audit2allow /var/log/audit/audit.log?
>
> yes just use this file instead of /tmp/avcs
> audit2allow -M local < /your/log/file

How long mush one give to the command?
I cleared the log, waited for two avc alerts.
ran: [root@frank-03 ~]# audit2allow -M local /var/log/audit/audit.log

It's been an hour so far.

Frank

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list

Frank Murphy wrote:

On Mon, 2008-07-07 at 11:27 +0200, drago01 wrote:


The logs are either in /var/log/audit.log (if audit is running)
otherwise in syslog (in this case passing -D to audit2allow will use
them)

audit2allow /var/log/audit/audit.log?

yes just use this file instead of /tmp/avcs
audit2allow -M local < /your/log/file


How long mush one give to the command?
I cleared the log, waited for two avc alerts.
ran: [root@frank-03 ~]# audit2allow -M local /var/log/audit/audit.log

It's been an hour so far.


What you typed isn't what was suggested. You missed the "<".

It's waiting for the end of file on stdin, which is your terminal.

Paul.

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list

On Tue, 2008-07-08 at 09:37 +0100, Paul Howarth wrote:
> Frank Murphy wrote:

> >> audit2allow -M local < /your/log/file
> >

> > ran: [root@frank-03 ~]# audit2allow -M local /var/log/audit/audit.log
> >
> > It's been an hour so far.
>
> What you typed isn't what was suggested. You missed the "<".
>
> It's waiting for the end of file on stdin, which is your terminal.
>
> Paul.

Good job the eye test is tomorrow
;(

Frank

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list