watching files in selinuxfs

[Debora Velarde]

When in enforcing mode, I am only able to audit files in selinuxfs by 
inode, not by path.    I am running as auditadm_r.

/* Try adding audit rule with -F path */
# auditctl -a exit,always -S open -F path=/selinux/enforce
Error sending add rule request (Permission denied)

# auditctl -l
No rules

/* Try adding audit rule with -w path syntax */
# auditctl -w /selinux/enforce
Error sending add rule request (Permission denied)

/* Try adding audit rule with -F inode */
# ls -i /selinux/enforce
4 /selinux/enforce

# auditctl -a exit,always -S open -F inode=4
# auditctl -l
LIST_RULES: exit,always inode=4 (0x4) syscall=open


Since it is possible to audit the files, this might only require a 
documentation change.  Perhaps adding a comment to the auditctl man page 
would be sufficient?

-debbie