Quote Originally Posted by q.dinar View Post
Code:
Feb 16 10:53:31 linux2009 kernel: [  382.914441] type=1505 audit(1234770811.273:665): operation="profile_replace" name="/usr/bin/xchat" name2="default" pid=7453
Feb 16 10:53:43 linux2009 kernel: [  395.513632] type=1502 audit(1234770823.873:666): operation="inode_permission" requested_mask="::x" denied_mask="::x" fsuid=1000 name="/sbin/killall5" pid=7460 profile="/usr/bin/xchat"
Feb 16 10:53:43 linux2009 kernel: [  395.514803] type=1504 audit(1234770823.873:667): operation="exec" info="set profile" pid=7460 profile="null-complain-profile"
Feb 16 10:53:43 linux2009 kernel: [  395.514830] type=1502 audit(1234770823.873:668): operation="file_permission" requested_mask="::r" denied_mask="::r" fsuid=1000 name="/sbin/killall5" pid=7460 profile="null-complain-profile"
Feb 16 10:53:43 linux2009 kernel: [  395.520025] type=1502 audit(1234770823.877:669): operation="file_permission" requested_mask="::r" denied_mask="::r" fsuid=1000 name="/sbin/killall5" pid=7460 profile="null-complain-profile"
Feb 16 10:53:43 linux2009 kernel: [  395.521749] type=1502 audit(1234770823.881:670): operation="file_permission" requested_mask="::r" denied_mask="::r" fsuid=1000 name="/sbin/killall5" pid=7460 profile="null-complain-profile"
Feb 16 10:53:43 linux2009 kernel: [  395.525482] type=1502 audit(1234770823.885:671): operation="inode_permission" requested_mask="::x" denied_mask="::x" fsuid=1000 name="/lib/ld-2.8.90.so" pid=7460 profile="null-complain-profile"
also xchat has asked for killall5.
I think I found this one. /bin/pidof is a symbolic link to /sbin/killall5. So programs that find /bin/pidof and follow the link rather than just calling 'pidof' will find themselves calling /sbin/killall5. My first instinct now is that this is harmless and it's the program trying to find a PID. Hopefully not its own, C has getpid() for that...

Quote Originally Posted by q.dinar View Post
what is null-complain-profile ?
Check out this post over at Novell's forums and see if that applies to you. null-complain-profile is used in learning mode, it complains about absolutely everything.