Re: filter specific file from specific program

I have a need to filter a file from auditing, but only from a specific process. We are running splunk, and indexing /var/log/audit/audit.log. We want audit.log to be monitored, so we are using a dir watch on /var/log/audit, but we just don't want splunk access to be reported. Filtering on obj_type doesn't work (-F obj_type=auditd_log_t), because it filters everything, not that specific process.

However, it actually spawns another process to do the actual access, so I can't filter on pid either. It runs unconfined,

so I can't filter on subj_type=unconfined_t, because that would filter way too much. It was suggested to me to use audit roles. If this is something separate from selinux context, perhaps someone can point me in the right direction? I only want to filter out (not audit) access to audit.log from the specific process /opt/splunkforwarder/bin/splunkd (and any forks it may do).