You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
45 lines
2.0 KiB
45 lines
2.0 KiB
From cfc1fde83d46d86d06ca2e76986cb4cf2607b188 Mon Sep 17 00:00:00 2001 |
|
From: Michal Sekletar <msekleta@redhat.com> |
|
Date: Tue, 26 Feb 2019 17:33:27 +0100 |
|
Subject: [PATCH] selinux: don't log SELINUX_INFO and SELINUX_WARNING messages |
|
to audit |
|
|
|
Previously we logged even info message from libselinux as USER_AVC's to |
|
audit. For example, setting SELinux to permissive mode generated |
|
following audit message, |
|
|
|
time->Tue Feb 26 11:29:29 2019 |
|
type=USER_AVC msg=audit(1551198569.423:334): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: received setenforce notice (enforcing=0) exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?' |
|
|
|
This is unnecessary and wrong at the same time. First, kernel already |
|
records audit event that SELinux was switched to permissive mode, also |
|
the type of the message really shouldn't be USER_AVC. |
|
|
|
Let's ignore SELINUX_WARNING and SELINUX_INFO and forward to audit only |
|
USER_AVC's and errors as these two libselinux message types have clear |
|
mapping to audit message types. |
|
|
|
(cherry picked from commit 6227fc14c48c4c17daed4b91f61cdd4aa375790a) |
|
|
|
Resolves: #1240730 |
|
--- |
|
src/core/selinux-access.c | 6 +++++- |
|
1 file changed, 5 insertions(+), 1 deletion(-) |
|
|
|
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c |
|
index 6cc0a49b92..8edfc86009 100644 |
|
--- a/src/core/selinux-access.c |
|
+++ b/src/core/selinux-access.c |
|
@@ -104,7 +104,11 @@ _printf_(2, 3) static int log_callback(int type, const char *fmt, ...) { |
|
va_end(ap); |
|
|
|
if (r >= 0) { |
|
- audit_log_user_avc_message(get_audit_fd(), AUDIT_USER_AVC, buf, NULL, NULL, NULL, 0); |
|
+ if (type == SELINUX_AVC) |
|
+ audit_log_user_avc_message(get_audit_fd(), AUDIT_USER_AVC, buf, NULL, NULL, NULL, 0); |
|
+ else if (type == SELINUX_ERROR) |
|
+ audit_log_user_avc_message(get_audit_fd(), AUDIT_USER_SELINUX_ERR, buf, NULL, NULL, NULL, 0); |
|
+ |
|
return 0; |
|
} |
|
}
|
|
|