Russell Coker eba35802cc yet more tiny stuff ... I think this should be self-explanatory. I've added an audit trace for the sys_ptrace access that was previously rejected. Here is the audit log for sys_ptrace: type=PROCTITLE msg=audit(22/01/19 00:00:18.998:61459) : proctitle=systemctl restart cups.service type=PATH msg=audit(22/01/19 00:00:18.998:61459) : item=0 name=/proc/1/root nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=CWD msg=audit(22/01/19 00:00:18.998:61459) : cwd=/ type=SYSCALL msg=audit(22/01/19 00:00:18.998:61459) : arch=x86_64 syscall=newfstatat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x55dd7ea7a23d a2=0x7ffee0a8a1b0 a3=0x0 items=1 ppid=12745 pid=12750 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemctl exe=/bin/systemctl subj=system_u:system_r:logrotate_t:s0 key=(null) type=AVC msg=audit(22/01/19 00:00:18.998:61459) : avc: denied { sys_ptrace } for pid=12750 comm=systemctl capability=sys_ptrace scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:system_r:logrotate_t:s0 tclass=capability permissive=0		2019-01-23 18:32:41 -05:00
..
admin	yet more tiny stuff	2019-01-23 18:32:41 -05:00
apps	yet more tiny stuff	2019-01-23 18:32:41 -05:00
kernel	kernel, jabber, ntp, init, logging, systemd: Module version bump.	2019-01-09 19:36:41 -05:00
roles	various: Module version bump.	2019-01-06 14:11:08 -05:00
services	yet more tiny stuff	2019-01-23 18:32:41 -05:00
system	yet more tiny stuff	2019-01-23 18:32:41 -05:00