RE: P.S. - RE: updates pending question
"Constance Morris" <[email protected]>
| Newsgroups | gmane.linux.redhat.general |
|---|---|
| Message-ID | <D82DF1C2744C6C43954D0E0E5E7697C801D965A22303@DSCEXCHANGE1.daltonstate.local> |
-----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of [email protected] Sent: Friday, May 10, 2013 4:19 PM To: General Red Hat Linux discussion list Subject: RE: P.S. - RE: [redhat-list] updates pending question Constance Morris wrote: > [mailto:[email protected]] On Behalf Of [email protected] <snip> >> You want a good laugh.....I did copy yours. Oops. >> I do not see any sealert info in the messages log. Do I need to run >> or rather start sealer? > > Nope. If auditd is running, that's all you need. If you see no > sealerts in /var/log/messages, or AVCs in /var/log/audit/audit.log, be > happy. The messages are for specific AVCs on *your* system, they're not generic. <snip> > I do get AVC messages in the audit.log file : > type=AVC msg=audit(1368211292.794:1593): avc: denied { search } for > pid=13587 comm="procmail" name="www" dev=dm-0 ino=3440923 > scontext=system_u:system_r:procmail_t:s0 > tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir Ok, and that really did happen, since you're enforcing, not permissive. There should be a message in /var/log/messages with the kind of wording I posted, and it'll give you the command line for sealert. Mark -------------------- Mark, This is all I see in the /var/log/messages area for setroubleshoot...... May 10 13:42:22 www yum: Installed: setroubleshoot-2.0.5-5.el5_8.1.noarch May 10 13:57:43 www setroubleshoot: [rpc.ERROR] attempt to open server connection failed: No such file or directory I really appreciate yours and Alfred's help and continued patience with me. I don't understand why this is so hard for me to fix and I'm sorry if I am being a pest. Constance -- redhat-list mailing list unsubscribe mailto:[email protected]?subject=unsubscribe https://www.redhat.com/mailman/listinfo/redhat-list