On Fri, Jun 7, 2013 at 8:29 PM, Matthew Garrett <mjg59@xxxxxxxxxxxxx> wrote: > So why not add a mechanism to permit applications to indicate that > certain accesses they make should be ignored by audit? Because it would be primarily useful to the attackers' applications. Or am I missing something? (BTW, audit already has something like "dontaudit" rules. But it has limited information to work with.) Mirek -- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel