Yep your right, i just wanted to point the fact that even if the logs are in messages instead of audit.log, audit2allow can be used (related to Wilkinson Matthew post). Birdy. _______________________________________________ selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx