audit.log shows that journald needs to read the kernel read buffer: avc: denied { syslog_read } for pid=147 comm="systemd-journal" scontext=system_u:system_r:syslogd_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 Moreover journald uses RW access to /dev/kmsg, according to its code: http://cgit.freedesktop.org/systemd/systemd/tree/src/journal/journald-kmsg.c?id=v215#n394 |
||
---|---|---|
.. | ||
admin | ||
apps | ||
contrib@ee5a05b5f3 | ||
kernel | ||
roles | ||
services | ||
system |