<html> <head> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> On 11/22/2016 08:55 AM, Stephen Smalley wrote: <blockquote cite="mid:1be21bc4-e70f-092f-13cb-458cc0beefad@tycho.nsa.gov" type="cite"> <blockquote type="cite" style="color: #000000;"> <pre wrap="">> OK. We can move the point where res=1 is set. But I would think that its a > requirement to have an audit record that states that policy failed to load. > FMT_MSA.3 Static Attribute Initialization. Auditable events: All modifications > of the initial value of security attributes. I would think this means changes > such as booleans, modifying labels, loading a new policy, or failure to load a > policy. </pre> </blockquote> <pre wrap="">Failure to load a policy is not a modification to the initial value of the security attribute, is it? </pre> </blockquote> It is definitely relevant, if it falls under another category. Either a failed malicious intent or a failed supervisory function. LCB </body> </html>