>That's fine, but the first thing I checked was "aureport --failed -a" and it >was silent about anything failing... What aureport considers a failure is syscalls that fail. For example, if you have your system in permissive mode, the syscall associated with any avcs would actually suceed. If you taked the --failed flag away, do you see the expected avc being reported? -Steve __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com -- fedora-selinux-list mailing list fedora-selinux-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-selinux-list