Comment 6 for bug 1948752

Revision history for this message
John Johansen (jjohansen) wrote :

Ah! The rule

```
 audit dbus bus=system,
```

is the problem. It is tagging every dbus match to be audited. You can drop that rule entirely, and just add dbus allow rules as needed, like the first 3 rules. Or you could allow all dbus system bus accesses by dropping the ```audit``` keyword, in which case you could also drop the first 3 dbus rules.

Unfortunately you can't do what this rule is trying to do atm, which allow dbus accesses but log the ones we don't know about, while enforcing the other rules. You can get something some what close by putting the profile into complain mode, which will log a message for every unknown access type, but it will also allow all accesses.