Public feed
#600484
contents of x.log:
kernel: audit(1183409243.944:48): avc: denied { create } for pid=1910 comm=irqbalance scontext=system_u:system_r:irqbalance_t:s0 tcontext=system_u:system_r:irqbalance_t:s0 tclass=udp_socket
kernel: audit(1183411202.000:83): avc: denied { search } for pid=1910 comm="irqbalance" name="net" dev=proc ino=-268435432 scontext=system_u:system_r:irqbalance_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=dir
kernel: audit(1183411202.000:84): avc: denied { read } for pid=1910 comm="irqbalance" name="dev" dev=proc ino=-268435157 scontext=system_u:system_r:irqbalance_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file
kernel: audit(1183411202.001:85): avc: denied { getattr } for pid=1910 comm="irqbalance" name="dev" dev=proc ino=-268435157 scontext=system_u:system_r:irqbalance_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file
kernel: audit(1183411222.000:86): avc: denied { ioctl } for pid=1910 comm="irqbalance" name="[15127]" dev=sockfs ino=15127 scontext=system_u:system_r:irqbalance_t:s0 tcontext=system_u:system_r:irqbalance_t:s0 tclass=udp_so
cket
result of running "audit2allow -i x.log -M mypolicypackage" on the above:
module mypolicypackage 1.0;
require {
type proc_net_t;
type irqbalance_t;
class udp_so ioctl;
class dir search;
class file { read getattr };
class udp_socket create;
}
#============= irqbalance_t ==============
allow irqbalance_t proc_net_t:dir search;
allow irqbalance_t proc_net_t:file { read getattr };
allow irqbalance_t self:udp_so ioctl;
allow irqbalance_t self:udp_socket create;
running "semodule -i mypolicypackage.pp" gives a Segmentation fault.