audit messages when there's no audit daemon

Steve Grubb sgrubb at redhat.com
Wed Jun 22 10:56:26 UTC 2005


On Wednesday 22 June 2005 02:50, David Woodhouse wrote:
> > We still have a minor problem. The new patch for hwclock in util-linux
> > causes it to put a big nasty audit message on the screen during
> > shutdown.
>
> Why isn't audit disabled at this point?

Which program would be responsible for disabling the audit system? init? 

Also, there are actions that occur on shutdown that SE Linux people need to 
see in order to correct policy. So, we can't affect AVC messages including 
USER_AVC.

-Steve




More information about the Linux-audit mailing list