78ac7f8 setroubleshoot-plugin: Fix catchall plugin message for capability2

1 file Authored by vmojzis 7 years ago, Committed by plautrba 7 years ago,
    setroubleshoot-plugin: Fix catchall plugin message for capability2
    
    Sealert now recognizes new class "capability2" (e.g. block_suspend)
    which should be treated as capability by this plugin.
    
    fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1360392
    
    type=AVC msg=audit(1468324670.938:596175): avc:  denied
    { block_suspend } for  pid=8442 comm="smtp" capability=36
    scontext=system_u:system_r:postfix_smtp_t:s0
    tcontext=system_u:system_r:postfix_smtp_t:s0 tclass=capability2
    
    *****  Plugin catchall (100. confidence) suggests   **************************
    
    If you believe that smtp should be allowed block_suspend access on the Unknown capability2 by default.
    Then you should report this as a bug.
    You can generate a local policy module to allow this access.
    Do allow this access for now by executing:
    
    Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
    
        
file modified
+1 -1