Hi, I received often the same message from Cron Daemon : su: avc.c :74 : avc_context_to_sid_raw: assertion « avc_running » failed. /etc/cron.hourly/logcheck.cron : ligne 10 : 17003 Abandon su -s /bin/bash -c /usr/sbin/logcheck logcheck run-parts: /etc/cron.hourly/logcheck.cron exited with return code 134 1 #!/bin/bash 2 3 set -e 4 5 if [ ! -d /var/lock/logcheck ]; then 6 mkdir -p /var/lock/logcheck 7 fi 8 chown -R logcheck:logcheck /var/lock/logcheck 9 10 su -s /bin/bash -c /usr/sbin/logcheck logcheck When running from root user, handly this comman, i get no message from auddit.log : su -s /bin/bash -c /usr/sbin/logcheck logcheck Portage 2.3.87 (python 3.6.9-final-0, default/linux/amd64/17.1/hardened/selinux, gcc-9.2.0, glibc-2.29-r7, 5.5.0-gentoo x86_64) ================================================================= System Settings ================================================================= System uname: Linux-5.5.0-gentoo-x86_64-Intel-R-_Core-TM-_i7-5557U_CPU_@_3.10GHz-with-gentoo-2.6 KiB Mem: 16268964 total, 1529116 free KiB Swap: 8388604 total, 8378364 free Timestamp of repository gentoo: Mon, 03 Feb 2020 00:45:01 +0000 Head commit of repository gentoo: cf12d7fd5d98f5209513bcc9b93388e98d785fd5 sh bash 4.4_p23-r1 ld GNU ld (Gentoo 2.32 p2) 2.32.0 ccache version 3.7.6 [enabled] app-shells/bash: 4.4_p23-r1::gentoo dev-java/java-config: 2.2.0-r4::gentoo dev-lang/perl: 5.30.1::gentoo dev-lang/python: 2.7.17::gentoo, 3.6.9::gentoo, 3.7.5-r1::gentoo dev-util/ccache: 3.7.6::gentoo dev-util/cmake: 3.14.6::gentoo dev-util/pkgconfig: 0.29.2::gentoo sys-apps/baselayout: 2.6-r1::gentoo sys-apps/openrc: 0.42.1::gentoo sys-apps/sandbox: 2.13::gentoo sys-devel/autoconf: 2.13-r1::gentoo, 2.69-r4::gentoo sys-devel/automake: 1.11.6-r3::gentoo, 1.16.1-r1::gentoo sys-devel/binutils: 2.32-r1::gentoo sys-devel/gcc: 9.2.0-r2::gentoo sys-devel/gcc-config: 2.1::gentoo sys-devel/libtool: 2.4.6-r6::gentoo sys-devel/make: 4.2.1-r4::gentoo sys-kernel/linux-headers: 4.19::gentoo (virtual/os-headers) sys-libs/glibc: 2.29-r7::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 sync-rsync-verify-metamanifest: yes sync-rsync-verify-max-age: 24 sync-rsync-extra-opts: sync-rsync-verify-jobs: 1 local location: /usr/local/portage masters: gentoo priority: 10 ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="@FREE" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=native -O2 -fforce-addr -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-march=native -O2 -fforce-addr -pipe" DISTDIR="/usr/portage/distfiles" EMERGE_DEFAULT_OPTS="--jobs=4 --load-average=4.0 --keep-going=y --with-bdeps=y --complete-graph" ENV_UNSET="DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs buildpkg ccache config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync multilib-strict network-sandbox news parallel-fetch parallel-install preserve-libs protect-owned sandbox selinux sesandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://miroir.my_local/gentoo/" LANG="fr_FR.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j5" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git " PORTAGE_TMPDIR="/var/tmp" USE="X acl amd64 branding bzip2 chroot consolekit crypt cryptsetup cxx ffmpeg gnutls hardened iconv icu ipv6 jpeg libtirpc logrotate lzma mmx modplug multilib ncurses nls nptl opengl openmp pam pax_kernel pcre perl pic pie png python readl ine seccomp secure_delete selinux snmp split-usr sse sse2 ssl ssp symlink tcpd unicode wavpack webrsync-gpg xattr xml xtpax zlib" ABI_X86="64" ADA_TARGET="gnat_2018" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10 k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_ dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_co nfig logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="load memory syslog" CPU_FLAGS_X86="aes avx avx2 f16c fma3 m mx mmxext pclmul popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm 104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="efi-64" INPUT_DEVICES="evdev keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_E XTENSIONS="presenter-console presenter-minimizer" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php7-2" POSTGRES_TARGETS="postgres10 postgres11" PYTHON_SINGLE_TARGET="python3_6" PYTHON_TARGETS="python2_7 python3_6" QEMU_SOFTMMU_TARGETS= "arm x86_64 sparc" QEMU_USER_TARGETS="x86_64" RUBY_TARGETS="ruby24 ruby25" USERLAND="GNU" VIDEO_CARDS="intel i915" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal r awnat logmark ipmark dhcpmac delude chaos account" Unset: CC, CPPFLAGS, CTARGET, CXX, INSTALL_MASK, LC_ALL, LINGUAS, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS ================================================================= Package Settings ================================================================= app-admin/logcheck-1.3.18-r1::gentoo was built with the following: USE="" ABI_X86="(64)" There is nothing in the logs : cat /var/log/audit/audit.log |egrep -i avc |egrep su type=AVC msg=audit(1580733285.495:14138): avc: denied { map } for pid=5754 comm="aide" path="/lib/modules/5.5.0-gentoo/kernel/net/sunrpc/sunrpc.ko" dev="dm-1" ino=5835422 scontext=system_u:system_r:system_cronjob_t tcontext=staff_u:object_r:modules_object_t tclass=file permissive=0 type=AVC msg=audit(1580733285.495:14139): avc: denied { map } for pid=5754 comm="aide" path="/lib/modules/5.5.0-gentoo/kernel/net/sunrpc/auth_gss/auth_rpcgss.ko" dev="dm-1" ino=5835418 scontext=system_u:system_r:system_cronjob_t tcontext=staff_u:object_r:modules_object_t tclass=file permissive=0 type=AVC msg=audit(1580733285.495:14140): avc: denied { map } for pid=5754 comm="aide" path="/lib/modules/5.5.0-gentoo/kernel/net/sunrpc/auth_gss/rpcsec_gss_krb5.ko" dev="dm-1" ino=5835420 scontext=system_u:system_r:system_cronjob_t tcontext=staff_u:object_r:modules_object_t tclass=file permissive=0 type=AVC msg=audit(1580733286.600:14381): avc: denied { open } for pid=5754 comm="aide" path="/lib/systemd/system/sysstat-summary.timer" dev="dm-1" ino=5647124 scontext=system_u:system_r:system_cronjob_t tcontext=system_u:object_r:systemd_unit_t tclass=file permissive=0 type=AVC msg=audit(1580733286.600:14382): avc: denied { open } for pid=5754 comm="aide" path="/lib/systemd/system/sysstat-summary.service" dev="dm-1" ino=5647125 scontext=system_u:system_r:system_cronjob_t tcontext=system_u:object_r:systemd_unit_t tclass=file permissive=0 type=USER_AVC msg=audit(1580740613.484:14447): pid=2323 uid=101 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t msg='avc: received setenforce notice (enforcing=0) exe="/usr/bin/dbus-daemon" sauid=101 hostname=? addr=? terminal=?' type=AVC msg=audit(1580740622.099:14471): avc: denied { read } for pid=23110 comm="lvm" name="file_contexts.subs_dist" dev="dm-1" ino=5317608 scontext=staff_u:sysadm_r:dracut_t tcontext=system_u:object_r:file_context_t tclass=file permissive=1 type=AVC msg=audit(1580740622.099:14471): avc: denied { open } for pid=23110 comm="lvm" path="/etc/selinux/strict/contexts/files/file_contexts.subs_dist" dev="dm-1" ino=5317608 scontext=staff_u:sysadm_r:dracut_t tcontext=system_u:object_r:file_context_t tclass=file permissive=1 type=AVC msg=audit(1580740622.099:14472): avc: denied { getattr } for pid=23110 comm="lvm" path="/etc/selinux/strict/contexts/files/file_contexts.subs_dist" dev="dm-1" ino=5317608 scontext=staff_u:sysadm_r:dracut_t tcontext=system_u:object_r:file_context_t tclass=file permissive=1 type=USER_AVC msg=audit(1580740793.507:14562): pid=2323 uid=101 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t msg='avc: received setenforce notice (enforcing=1) exe="/usr/bin/dbus-daemon" sauid=101 hostname=? addr=? terminal=?'
And from the mail of Security Events : From: added by portage for logcheck Security Events for su =-=-=-=-=-=-=-=-=-=-=- Feb 3 15:01:01 localhost su[17003]: avc: could not determine enforcing mode: Permission not allow Feb 3 15:01:01 localhost su[17003]: avc: could not determine enforcing mode: Permission not allow
