From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael C Thompson <thompsmc@us.ibm.com>
Subject: auditctl se_sen & se_clr
Date: Fri, 19 May 2006 10:07:13 -0500
Message-ID: <446DDF21.4080808@us.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31])
	by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id
	k4JF7aA5023999
	for <linux-audit@redhat.com>; Fri, 19 May 2006 11:07:36 -0400
Received: from e34.co.us.ibm.com (e34.co.us.ibm.com [32.97.110.152])
	by mx1.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id
	k4JF7XEB014622
	for <linux-audit@redhat.com>; Fri, 19 May 2006 11:07:33 -0400
Received: from westrelay02.boulder.ibm.com (westrelay02.boulder.ibm.com
	[9.17.195.11])
	by e34.co.us.ibm.com (8.12.11.20060308/8.12.11) with ESMTP id
	k4JF7OhW031684
	for <linux-audit@redhat.com>; Fri, 19 May 2006 11:07:24 -0400
Received: from d03av02.boulder.ibm.com (d03av02.boulder.ibm.com [9.17.195.168])
	by westrelay02.boulder.ibm.com (8.12.10/NCO/VER6.8) with ESMTP id
	k4JF7IYH240770
	for <linux-audit@redhat.com>; Fri, 19 May 2006 09:07:24 -0600
Received: from d03av02.boulder.ibm.com (loopback [127.0.0.1])
	by d03av02.boulder.ibm.com (8.12.11/8.13.3) with ESMTP id
	k4JF7I8C020155
	for <linux-audit@redhat.com>; Fri, 19 May 2006 09:07:18 -0600
Received: from [127.0.0.1] ([9.41.46.77])
	by d03av02.boulder.ibm.com (8.12.11/8.12.11) with ESMTP id
	k4JF7HwA020116
	for <linux-audit@redhat.com>; Fri, 19 May 2006 09:07:17 -0600
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Linux Audit <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

Hey all,

I'm trying to figure out how the se_sen and se_clr labels are supposed 
to be used with auditctl.

Here is the selinux context:
subj=root:staff_r:staff_t:s0-s15:c0.c255
       ^      ^       ^        ^
    se_user   ^    se_type     ^
            se_role          se_clr & se_sen

What is the difference between se_clr and se_sen? And if you have any 
enlightening examples, that would be appreciated.

Thanks,
Mike