I'm trying to create an audit rule to exclude all rsync actions when run by a process with a certain subject type (jcdx_fsbackup_t). Our policy allows the action to happen, however as a result we generate a ton of audit data on file access and recreation at the target point. Anyone have a good idea of how to discard all these events? Ideally the caller would send in a self-generated event such as "ryncing rick/src2/ to /temp-home" or similar. This is for a dedicated file backup procedure. Obviously I do not want to discard all rsync events, just when launched by our trusted program. Nor would I really want all that program's events discarded since I want it to be able to submit proactive events which summarize its behavior. Below are some event samples. Other ideas are welcome also if my approach is myopic/flawed. Thx, LCB. ---- node=develop.local.austin.rr.com type=PATH msg=audit(06/22/2009 15:05:37.017:901990) : item=0 name=rick/path1/path2/path3/k4jtCX inode=203842 dev=fd:04 mode=file,600 ouid=root ogid=unknown(1106) rdev=00:00 obj=siterep_u:object_r:user_home_t:s0 node=develop.local.austin.rr.com type=CWD msg=audit(06/22/2009 15:05:37.017:901990) : cwd=/temp_home node=develop.local.austin.rr.com type=SYSCALL msg=audit(06/22/2009 15:05:37.017:901990) : arch=x86_64 syscall=lchown success=yes exit=0 a0=7ffff2994e30 a1=1f7 a2=44c a3=1 items=1 ppid=5445 pid=5446 auid=rick uid=root gid=unknown(1106) euid=root suid=root fsuid=root egid=unknown(1106) sgid=unknown(1106) fsgid=unknown(1106) tty=pts2 ses=1 comm=rsync exe=/usr/bin/rsync subj=siterep_u:siterep_r:dx_fsbackup_t:s15:c0.c1023 key=perm_mod ... ---- node=develop.local.austin.rr.com type=PATH msg=audit(06/22/2009 15:05:37.017:901997) : item=3 name=rick/path1/path2/path3/f1 inode=203843 dev=fd:04 mode=file,444 ouid=unknown(503) ogid=unknown(1100) rdev=00:00 obj=system_u:object_r:user_home_t:s0 node=develop.local.austin.rr.com type=PATH msg=audit(06/22/2009 15:05:37.017:901997) : item=2 name=rick/path1/path2/path3/f2 inode=203843 dev=fd:04 mode=file,444 ouid=unknown(503) ogid=unknown(1100) rdev=00:00 obj=system_u:object_r:user_home_t:s0 node=develop.local.austin.rr.com type=PATH msg=audit(06/22/2009 15:05:37.017:901997) : item=1 name=rick/path1/path2/path3/d1 inode=203324 dev=fd:04 mode=dir,755 ouid=unknown(503) ogid=unknown(1100) rdev=00:00 obj=system_u:object_r:user_home_t:s0 node=develop.local.austin.rr.com type=PATH msg=audit(06/22/2009 15:05:37.017:901997) : item=0 name=rick/path1/path2/path3/d2 inode=203324 dev=fd:04 mode=dir,755 ouid=unknown(503) ogid=unknown(1100) rdev=00:00 obj=system_u:object_r:user_home_t:s0 node=develop.local.austin.rr.com type=CWD msg=audit(06/22/2009 15:05:37.017:901997) : cwd=/temp_home node=develop.local.austin.rr.com type=SYSCALL msg=audit(06/22/2009 15:05:37.017:901997) : arch=x86_64 syscall=rename success=yes exit=0 a0=7ffff2994e30 a1=7ffff2996e30 a2=0 a3=0 items=4 ppid=5445 pid=5446 auid=rick uid=root gid=unknown(1106) euid=root suid=root fsuid=root egid=unknown(1106) sgid=unknown(1106) fsgid=unknown(1106) tty=pts2 ses=1 comm=rsync exe=/usr/bin/rsync subj=siterep_u:siterep_r:dx_fsbackup_t:s15:c0.c1023 key=delete -- LC (Lenny) Bruzenak lenny(a)magitekltd.com