1 |
On Wed, Jan 19, 2011 at 02:05:39PM -0600, Chris Richards wrote: |
2 |
> As I mentioned previously, my concern with having harmless AVCs in the |
3 |
> log is that we create a situation where the System Admin gets so used to |
4 |
> seeing all of these AVCs that he gets in the habit of ignoring them. |
5 |
> Being in the habit of ignoring stuff in the logs is, IMO, a Bad Thing |
6 |
> because it increases the likelihood of ignoring something important. |
7 |
> |
8 |
> That being said, troubleshooting a system where legitimate AVCs are |
9 |
> being dontaudited can be difficult, and determining if an AVC should be |
10 |
> dontaudited can involve digging through a LOT of code. Perhaps we |
11 |
> should leave the AVCs we aren't certain of for a bit, with an eye to |
12 |
> either dontauditing or fixing them at a later date? |
13 |
|
14 |
Hmm, perhaps with a tunable_policy called `gentoo_try_dontaudit' or |
15 |
something similar. The boolean could provide additional benefit as it sais |
16 |
to the end user "hey, if you enable this, you'll get less AVC denials but we |
17 |
are not fully confident yet that they are true ignorable denials", unlike |
18 |
the "semodule -D" approach which also disables all real ignorable dontaudit |
19 |
denials. |
20 |
|
21 |
Wkr, |
22 |
Sven Vermeulen |