From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael C Thompson Subject: Re: auditctl se_sen & se_clr Date: Fri, 26 May 2006 10:43:27 -0500 Message-ID: <4477221F.10201@us.ibm.com> References: <446DDF21.4080808@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k4QFhjpJ025765 for ; Fri, 26 May 2006 11:43:45 -0400 Received: from e2.ny.us.ibm.com (e2.ny.us.ibm.com [32.97.182.142]) by mx3.redhat.com (8.13.1/8.13.1) with ESMTP id k4QFhdbm004283 for ; Fri, 26 May 2006 11:43:39 -0400 Received: from d01relay04.pok.ibm.com (d01relay04.pok.ibm.com [9.56.227.236]) by e2.ny.us.ibm.com (8.12.11.20060308/8.12.11) with ESMTP id k4QFhWpv014071 for ; Fri, 26 May 2006 11:43:32 -0400 Received: from d01av01.pok.ibm.com (d01av01.pok.ibm.com [9.56.224.215]) by d01relay04.pok.ibm.com (8.12.10/NCO/VER6.8) with ESMTP id k4QFhVpF050062 for ; Fri, 26 May 2006 11:43:31 -0400 Received: from d01av01.pok.ibm.com (loopback [127.0.0.1]) by d01av01.pok.ibm.com (8.12.11.20060308/8.13.3) with ESMTP id k4QFhV91019125 for ; Fri, 26 May 2006 11:43:31 -0400 In-Reply-To: <446DDF21.4080808@us.ibm.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Michael C Thompson Cc: Linux Audit List-Id: linux-audit@redhat.com Michael C Thompson wrote: > Hey all, > > I'm trying to figure out how the se_sen and se_clr labels are supposed > to be used with auditctl. > > Here is the selinux context: > subj=root:staff_r:staff_t:s0-s15:c0.c255 > ^ ^ ^ ^ > se_user ^ se_type ^ > se_role se_clr & se_sen > > What is the difference between se_clr and se_sen? And if you have any > enlightening examples, that would be appreciated. This is no longer an issue, it has been resolved since .28 kernel and audit-1.2.3. Thanks, Mike