Bug#953860: how to reproduce

[Russell Coker]

On Saturday, 11 April 2020 5:19:00 PM AEST Michael Biebl wrote:
> > type=AVC msg=audit(1586512443.135:71139): avc:  granted  { unlink } for
> > pid=293 comm="systemd-journal"
> > name="user-1001 at 165b61313e51499ab58ffd33d611e714-0000000000000000-00000000
> > 00000000.journal" dev="sdb2" ino=2093618
> > scontext=system_u:system_r:syslogd_t:s0
> > tcontext=system_u:object_r:systemd_journal_t:s0 tclass=file
> > type=AVC msg=audit(1586565837.001:94320): avc:  granted  { unlink } for
> > pid=293 comm="systemd-journal"
> > name="user-1001 at 165b61313e51499ab58ffd33d611e714-0000000000000000-00000000
> > 00000000.journal" dev="sdb2" ino=2095421
> > scontext=system_u:system_r:syslogd_t:s0
> > tcontext=system_u:object_r:systemd_journal_t:s0 tclass=file
> 
> Is another user/process accessing the journal file at the time the
> delete happens?

Not through any deliberate user action.  I'm the only user of the system and I 
wasn't running any journalctl command.  Does systemd do such stuff internally?

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/