On Fri, 2008-01-11 at 16:06 -0500, Chuck Anderson wrote: > Is there any way to tell from the audit log or elsewhere when > someone/something changed SELinux from enforcing to permissive or vice > versa? Look for MAC_STATUS records in the audit log, e.g. /sbin/ausearch -m MAC_STATUS These include changes to enforcing mode, with the enforcing= and old_enforcing= values. -- Stephen Smalley National Security Agency -- fedora-selinux-list mailing list fedora-selinux-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-selinux-list
