1 |
On 01/19/2011 02:25 PM, Sven Vermeulen wrote: |
2 |
> On Wed, Jan 19, 2011 at 02:05:39PM -0600, Chris Richards wrote: |
3 |
>> As I mentioned previously, my concern with having harmless AVCs in the |
4 |
>> log is that we create a situation where the System Admin gets so used to |
5 |
>> seeing all of these AVCs that he gets in the habit of ignoring them. |
6 |
>> Being in the habit of ignoring stuff in the logs is, IMO, a Bad Thing |
7 |
>> because it increases the likelihood of ignoring something important. |
8 |
>> |
9 |
>> That being said, troubleshooting a system where legitimate AVCs are |
10 |
>> being dontaudited can be difficult, and determining if an AVC should be |
11 |
>> dontaudited can involve digging through a LOT of code. Perhaps we |
12 |
>> should leave the AVCs we aren't certain of for a bit, with an eye to |
13 |
>> either dontauditing or fixing them at a later date? |
14 |
> Hmm, perhaps with a tunable_policy called `gentoo_try_dontaudit' or |
15 |
> something similar. The boolean could provide additional benefit as it sais |
16 |
> to the end user "hey, if you enable this, you'll get less AVC denials but we |
17 |
> are not fully confident yet that they are true ignorable denials", unlike |
18 |
> the "semodule -D" approach which also disables all real ignorable dontaudit |
19 |
> denials. |
20 |
> |
21 |
|
22 |
Now THAT'S an idea a like! |
23 |
|
24 |
Later, |
25 |
Chris |