When trying analyze things that don't work as expected, I sometimes
need to disable the dontaudit rules from the policy. There seems to
be (at least) two ways to do that:

semanage dontaudit off

and

semodule -DB

Is there some difference in the effect of these two commands? Or is
it just two ways to do the same thing?
--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux

On Tue, 2011-09-27 at 17:46 +0200, Göran Uddeborg wrote:
> When trying analyze things that don't work as expected, I sometimes
> need to disable the dontaudit rules from the policy. There seems to
> be (at least) two ways to do that:
>
> semanage dontaudit off
>
> and
>
> semodule -DB
>
> Is there some difference in the effect of these two commands? Or is
> it just two ways to do the same thing?

probably the same thing.

> --
> selinux mailing list
> selinux@lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux

--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/27/2011 11:46 AM, Göran Uddeborg wrote:
> When trying analyze things that don't work as expected, I
> sometimes need to disable the dontaudit rules from the policy.
> There seems to be (at least) two ways to do that:
>
> semanage dontaudit off
>
> and
>
> semodule -DB
>
> Is there some difference in the effect of these two commands? Or
> is it just two ways to do the same thing? -- selinux mailing list
> selinux@lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
Should be the same.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk6CC4UACgkQrlYvE4MpobMj2wCg4c1O3kNLS1 fk2gudc/4Cnymo
+r8AoLpTMwB6vtfrI9XUDnR3NvuclZdq
=l5EE
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux

Daniel J Walsh:
> Should be the same.

I see. Thanks!
--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux