1

I was looking into my selinux alert logfile and running over multiple entries labeled

**** Invalid AVC allowed in current policy ***

I understand that this signals a problem (on read or getattr etc.) and I see which processes cause it, but what I do not understand is the label.

What is an Invalid AVC? And how can it be allowed?

1 Answer 1

1

In the source for setroubleshoot, you can see that this is where the error comes from:

self.why, bools = audit2why.analyze(str(self.scontext), str(self.tcontext), str(self.tclass), self.access)
    if self.why == audit2why.ALLOW:
        raise ValueError(_("%s \n**** Invalid AVC allowed in current policy ***\n") %  self.avc_record)

This code suggests that the message is prepended by self.avc_record. I don't have a lot of time right now, but as the method this code is in is called derive_avc_info_from_audit_event, I am guessing this means an audit.log message is not correctly parsed into AVC information.

The messages in the rest of the if ... else block suggest this could be caused by a bug in the policy.

Maybe you can post the complete error: I haven't seen this before and knowing the exact output might help shedding some light onto it.

1
  • Could be, I always updated the policy with suggestions from the plugins, now my sealerter doesn't work any longer so I'm pretty sure those automations have destroyed the policy. Maybe a reinstall of the system helps.
    – hakre
    Jul 3, 2011 at 18:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .