{"action":"opened","issue":{"url":"https://api.github.com/repos/systemd/systemd/issues/1941","labels_url":"https://api.github.com/repos/systemd/systemd/issues/1941/labels{/name}","comments_url":"https://api.github.com/repos/systemd/systemd/issues/1941/comments","events_url":"https://api.github.com/repos/systemd/systemd/issues/1941/events","html_url":"https://github.com/systemd/systemd/issues/1941","id":117538953,"number":1941,"title":"systemd --user doesn't have audit_write support","user":{"login":"bigon","id":264358,"avatar_url":"https://avatars.githubusercontent.com/u/264358?v=3","gravatar_id":"","url":"https://api.github.com/users/bigon","html_url":"https://github.com/bigon","followers_url":"https://api.github.com/users/bigon/followers","following_url":"https://api.github.com/users/bigon/following{/other_user}","gists_url":"https://api.github.com/users/bigon/gists{/gist_id}","starred_url":"https://api.github.com/users/bigon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bigon/subscriptions","organizations_url":"https://api.github.com/users/bigon/orgs","repos_url":"https://api.github.com/users/bigon/repos","events_url":"https://api.github.com/users/bigon/events{/privacy}","received_events_url":"https://api.github.com/users/bigon/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-11-18T08:36:40Z","updated_at":"2015-11-18T08:36:40Z","closed_at":null,"body":"Hi,\r\n\r\nShouldn't the systemd --user instance keep the audit_write capability?\r\n\r\nI'm seeing things like that in syslog: \r\n\r\n    nov 18 09:20:17 fornost systemd[2569]: Can't send to audit system: USER_AVC avc:  denied  { reload } for auid=n/a uid=1000 gid=1000 cmdline=\"/bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:pa\r\n                                        exe=\"/lib/systemd/systemd\" sauid=0 hostname=? addr=? terminal=?\r\n\r\nI know it's a bug in the SELinux policy, but this kind of things should be logged in audit"}}