Running targeted/enforcing, latest Rawhide. Noticed this in /var/log/messages, before auditd is started I guess: Jun 29 06:43:48 localhost kernel: audit(1151588567.562:102): avc: denied { getattr } for pid=1526 comm="pam_console_app" name="usbdev5.5_ep02" dev=tmpfs ino=5143 scontext=system_u:system_r:pam_console_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file Jun 29 06:43:48 localhost kernel: audit(1151588567.562:103): avc: denied { getattr } for pid=1526 comm="pam_console_app" name="usbdev5.5_ep81" dev=tmpfs ino=5120 scontext=system_u:system_r:pam_console_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file Jun 29 06:43:48 localhost kernel: audit(1151588567.562:104): avc: denied { getattr } for pid=1526 comm="pam_console_app" name="usbdev5.5_ep00" dev=tmpfs ino=5068 scontext=system_u:system_r:pam_console_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file << actually many, many copies of these....>> tom -- Tom London -- fedora-selinux-list mailing list fedora-selinux-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-selinux-list