>dbusd avc audit messages are generated by libselinux using a callback >function provided by dbusd, and dbusd likely is just using syslog() >rather than communicating with the audit daemon. I traced through the code and created a patch for dbus to use libaudit. It now works fine. But, I noticed the kernel generated messages have more information in them. I guess that's what the audit hook (avc_func_audit) was for. -Steve Grubb __________________________________ Do you Yahoo!? Yahoo! Mail - Helps protect you from nasty viruses. http://promotions.yahoo.com/new_mail