action #120070: Upload and check the content of audit.log - ALP - openSUSE Project Management Tool

Actions

Copy link

action #120070

closed

Upload and check the content of audit.log

Added by mloviska about 2 years ago. Updated about 2 years ago.

Status:

Resolved

Priority:

High

Assignee:

mloviska

Target version:

Start date:

2022-11-08

Due date:

% Done:

Estimated time:

Difficulty:

Description

Expand journal_check.pm to handle audit.log content. Currently, SELinux runs in permissive mode, meaning it logs denials but does not act upon them.

Search for AVC denials in /var/log/audit/audit.log.

Actions

Copy link

Updated by jsegitz about 2 years ago

Thanks for opening this ticket. Let me add some details I discussed with various people:

Goal is to get AVC denials for arbitrary tests, not for a single test.
Having a mapping between AVC and test would be necessary. Doesn't need to be super granular, but at least to know which high level test triggered which AVC

This is the requirement for now. Later on we might want to have a baseline defined for each test and fail upon new AVCs, but that is just something that you might want to consider when planning the original solution. That's not necessary for now

Actions

Copy link