Re: [CentOS] OpenDKIM and SELinux

On Mon, May 12, 2014 14:05, Daniel J Walsh wrote:

...

dac_read_search and dac_override are usually bad to add. They typically mean the permission flags on the file in question is two tight for a root process to read/use.

Loosing up the group/other permissions would probably allow a root process to read the object without requiring these capabities.

I just wrote a quick blog on this.

https://danwalsh.livejournal.com/69478.html

So, to turn on full path reporting I do this:

# echo "-w /etc/shadow -p w" >> /etc/audit/audit.rules # service auditd restart

My question is: what is the effect that "-w /etc/shadow -p w" has on SELinux with respect to reporting the full path of file names in AVCs? In other words, why does that work?