Re: systemd and dontaudit

On Wednesday, 23 July 2025 22:37:09 AEST Chris PeBenito wrote:
> On 7/22/2025 8:15 PM, Russell Coker wrote:
> > kernel_dontaudit_getattr_proc(systemd_logind_t)
> > 
> > The above hides the fact that systemd-logind wants to statfs /proc and
> > that
> > can cause it to abort in some situations, to refuse to respond to dbus
> > requests, and to delay all logins by 25 seconds.
> 
> Can you elaborate on what one of those failing situations is?

It only happened repeatedly on one of my systems.  I think that triggering 
that particular condition required multiple settings, so just not allowing 
statfs isn't necessarily enough, some other combination of things allowed and 
denied seemed necessary to get it into that state. The one system that had 
this had it persist across reboots but other systems never had it.  I had seen 
it briefly happen on other systems but a reboot fixed it.

I didn't put as much effort into investigating this as I might have because 
the access in question is fairly innocuous.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/